Keep shdeps release bootstrap local (#22)

Avoid doing foreground GitHub release freshness checks while sourcing
`install.sh --bootstrap` for an existing release install. Bootstrap is
on callers' startup path, and a transient GitHub 504 could delay
commands like `dot update` before they had a chance to render their own
UI.

This keeps release installs local by default during bootstrap, while
still allowing `SHDEPS_FORCE=1` to perform an immediate release refresh
before the wrapper is sourced. Source checkout installs keep their
existing bootstrap self-update behavior.

The old Bash release-tag comparator and stale-refresh helper are removed
now that normal release freshness is no longer owned by the sourceable
installer bootstrap path.

Testing:
- `bash -n install.sh tests/shell/install-sh-test
tests/shell/installer-flow-test`
- `shellcheck install.sh tests/shell/install-sh-test
tests/shell/installer-flow-test`
- `tests/shell/install-sh-test`
- `tests/shell/installer-flow-test`
- `cargo test --locked`
- `cargo build --locked`
- `SHDEPS_RUST_CLI=target/debug/shdeps tests/shell/shdeps-wrapper-test`
- `tests/shell/release-scripts-test`
- `cargo clippy --locked --all-targets -- -D warnings`
- `RUSTDOCFLAGS='-D missing-docs' cargo doc --locked --no-deps`
- `tests/shell/lua-api-test`
- `tests/shell/lua-bootstrap-test`
- `/bin/bash scripts/smoke-install-bash32.sh`
- verified the curl-wrapper bootstrap probe against the patched
installer returned in 0s with no curl call on an affected release
install
- `git diff --check`

Not run locally: `scripts/package-release.sh x86_64-unknown-linux-musl
linux-x86_64-musl` and `scripts/smoke-release.sh linux-x86_64-musl`,
because the local workstation does not have `rustup` or the
`x86_64-unknown-linux-musl` Rust target installed; CI installs that
target before running the package smoke.

Author: cgraf78

install.sh

@@ -257,144 +257,6 @@ _json_string() {
   sed -n "s/.*\"$key\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p" "$file" | head -n 1
 }
 
-_installed_release_tag() {
-  local dir="$1"
-
-  _json_string "$dir/.shdeps-install.json" "tag"
-}
-
-_release_tag_newer() {
-  local latest="$1" current="$2"
-
-  [[ -n "$latest" ]] || return 1
-  # When no current tag exists we cannot compute "newer than"; let the
-  # caller decide whether to install. (The bootstrap refresh path already
-  # short-circuits this case; this branch is here for direct callers.)
-  [[ -n "$current" ]] || return 0
-  [[ "$(_natural_tag_cmp "$latest" "$current")" == "gt" ]]
-}
-
-# Natural-order tag comparison shared with the Rust self-update path.
-#
-# Stable lexical comparison of release tags works for shdeps' own
-# `YYYYMMDD-HHMMSS-<hash>` format because the timestamp prefix is
-# zero-padded. It silently breaks down for any tag scheme with a numeric
-# component that grows past 9 (e.g., `v1.10` vs `v1.9`, where lexical
-# comparison incorrectly orders `v1.10` before `v1.9`). The Rust
-# implementation in `src/self_update.rs::compare_tags` already does a
-# natural sort that treats numeric runs by trimmed length and then by
-# bytes, with numeric runs sorting after text runs. Mirror that here so
-# bootstrap-time and runtime self-update agree on which release is newer
-# for every possible tag scheme.
-#
-# Echoes one of `lt`, `eq`, `gt` to stdout. Stays Bash 3.2-compatible
-# because `install.sh` runs from the curl-pipe path on macOS's stock
-# /bin/bash.
-_natural_tag_cmp() {
-  local left="$1" right="$2"
-  local left_pos=0 right_pos=0
-  local left_len=${#left} right_len=${#right}
-  local lc rc l_run r_run l_digit r_digit l_trim r_trim
-
-  while [[ $left_pos -lt $left_len || $right_pos -lt $right_len ]]; do
-    if [[ $left_pos -ge $left_len ]]; then
-      echo "lt"
-      return
-    fi
-    if [[ $right_pos -ge $right_len ]]; then
-      echo "gt"
-      return
-    fi
-
-    # Determine whether the next run on each side is numeric or textual.
-    lc="${left:$left_pos:1}"
-    rc="${right:$right_pos:1}"
-    case "$lc" in [0-9]) l_digit=1 ;; *) l_digit=0 ;; esac
-    case "$rc" in [0-9]) r_digit=1 ;; *) r_digit=0 ;; esac
-
-    # Extract the maximal same-class run from each side.
-    l_run=""
-    if [[ $l_digit -eq 1 ]]; then
-      while [[ $left_pos -lt $left_len ]]; do
-        case "${left:$left_pos:1}" in [0-9]) ;; *) break ;; esac
-        l_run="$l_run${left:$left_pos:1}"
-        left_pos=$((left_pos + 1))
-      done
-    else
-      while [[ $left_pos -lt $left_len ]]; do
-        case "${left:$left_pos:1}" in [0-9]) break ;; esac
-        l_run="$l_run${left:$left_pos:1}"
-        left_pos=$((left_pos + 1))
-      done
-    fi
-    r_run=""
-    if [[ $r_digit -eq 1 ]]; then
-      while [[ $right_pos -lt $right_len ]]; do
-        case "${right:$right_pos:1}" in [0-9]) ;; *) break ;; esac
-        r_run="$r_run${right:$right_pos:1}"
-        right_pos=$((right_pos + 1))
-      done
-    else
-      while [[ $right_pos -lt $right_len ]]; do
-        case "${right:$right_pos:1}" in [0-9]) break ;; esac
-        r_run="$r_run${right:$right_pos:1}"
-        right_pos=$((right_pos + 1))
-      done
-    fi
-
-    # Cross-class: numeric runs sort AFTER text runs so `v10` > `vbeta`.
-    if [[ $l_digit -ne $r_digit ]]; then
-      if [[ $l_digit -eq 1 ]]; then echo "gt"; else echo "lt"; fi
-      return
-    fi
-
-    if [[ $l_digit -eq 1 ]]; then
-      # Numeric: trim leading zeros, compare by length first (so 10 > 9
-      # without ever fitting into a fixed-width integer), then by bytes
-      # for the same-length case.
-      l_trim="${l_run#"${l_run%%[!0]*}"}"
-      r_trim="${r_run#"${r_run%%[!0]*}"}"
-      [[ -z "$l_trim" ]] && l_trim="0"
-      [[ -z "$r_trim" ]] && r_trim="0"
-      if [[ ${#l_trim} -lt ${#r_trim} ]]; then
-        echo "lt"
-        return
-      fi
-      if [[ ${#l_trim} -gt ${#r_trim} ]]; then
-        echo "gt"
-        return
-      fi
-      # `<` / `>` inside `[[ ]]` is lexicographic; on equal-length pure
-      # digit strings that matches numeric ordering exactly. Use it
-      # instead of `(( ))` so the comparison stays correct for numbers
-      # that exceed bash's integer width. shellcheck SC2071 misreads
-      # the intent so disable it inline rather than reshape the code.
-      # shellcheck disable=SC2071
-      if [[ "$l_trim" < "$r_trim" ]]; then
-        echo "lt"
-        return
-      fi
-      # shellcheck disable=SC2071
-      if [[ "$l_trim" > "$r_trim" ]]; then
-        echo "gt"
-        return
-      fi
-    else
-      # shellcheck disable=SC2071
-      if [[ "$l_run" < "$r_run" ]]; then
-        echo "lt"
-        return
-      fi
-      # shellcheck disable=SC2071
-      if [[ "$l_run" > "$r_run" ]]; then
-        echo "gt"
-        return
-      fi
-    fi
-  done
-  echo "eq"
-}
-
 _asset_url() {
   local file="$1" name="$2"
 
@@ -693,34 +555,6 @@ _cleanup_installed_state_for_source_checkout() {
   fi
 }
 
-_refresh_release_install_if_stale() {
-  local current latest repo
-
-  _uses_default_repo_slug || return 0
-  _is_release_install_dir "$SHDEPS_DIR" || return 0
-
-  repo=$(_repo_slug)
-  current=$(_installed_release_tag "$SHDEPS_DIR")
-  # When the local install metadata is missing a `tag` field, we have no
-  # comparison baseline. Treating "no current tag" as "always stale" used
-  # to fire a `_install_release` call on every shell startup, hammering
-  # GitHub for an install that was probably fine. A missing tag indicates
-  # either a fresh install (which `_install_release` ran moments ago) or
-  # a corrupted state file (which the user repairs by re-running the
-  # installer explicitly). Either way, the background refresh should be
-  # a no-op rather than a silent re-download loop.
-  [[ -n "$current" ]] || return 0
-  latest=$(_latest_release_tag "$repo") || return 0
-
-  # Bootstrap self-update has to be conservative but useful. Release tags are
-  # timestamp-prefixed (`YYYYMMDD-HHMMSS-<hash>`), so lexical ordering is enough
-  # to avoid replacing a newer local archive with an older or deleted GitHub
-  # "latest" release while still advancing normal fleet installs promptly.
-  if _release_tag_newer "$latest" "$current"; then
-    _install_release >/dev/null 2>&1 || true
-  fi
-}
-
 _install_release() {
   local platform repo api_url token tmp json tag archive checksum
   local archive_url checksum_url archive_api_url checksum_api_url bundle
@@ -1030,7 +864,9 @@ _install() {
 # ---------------------------------------------------------------------------
 # Designed to be sourced: `. /path/to/install.sh --bootstrap`
 #
-# Finds shdeps.sh, sources it, symlinks the CLI, and runs self-update.
+# Finds shdeps.sh, sources it, and symlinks the CLI. Source checkouts still
+# self-update during bootstrap; release installs stay local unless forced so
+# callers are not blocked on GitHub before they can render their own UI.
 # Clients set env vars (SHDEPS_CONF_DIR, SHDEPS_HOOKS_DIR, etc.) before
 # sourcing.
 #
@@ -1040,7 +876,7 @@ _bootstrap() {
   # Idempotent — skip if already bootstrapped
   declare -f shdeps_update &>/dev/null && return 0
 
-  local _bs_lib="" _bs_dir=""
+  local _bs_lib="" _bs_dir="" _bs_release_install=0
   local _dev_dir="${SHDEPS_GIT_DEV_DIR:-$HOME/git}"
 
   # Find shdeps.sh: installed-tree env hint → env override → dev clone →
@@ -1051,8 +887,8 @@ _bootstrap() {
   if _bootstrap_lib_is_installed_tree; then
     if _uses_default_repo_slug && [[ -d "$SHDEPS_DIR/.git" ]]; then
       _install_release >/dev/null 2>&1 || true
-    else
-      _refresh_release_install_if_stale
+    elif [[ "${SHDEPS_FORCE:-0}" == 1 ]] && _is_release_install_dir "$SHDEPS_DIR"; then
+      _install_release >/dev/null 2>&1 || true
     fi
     _bs_lib="$SHDEPS_DIR/shdeps.sh"
     _bs_dir="$SHDEPS_DIR"
@@ -1070,8 +906,8 @@ _bootstrap() {
       # this opportunistic: failed downloads, dirty checkouts, or unsupported
       # platforms fall through to the source path so bootstrap still converges.
       _install_release >/dev/null 2>&1 || true
-    else
-      _refresh_release_install_if_stale
+    elif [[ "${SHDEPS_FORCE:-0}" == 1 ]] && _is_release_install_dir "$SHDEPS_DIR"; then
+      _install_release >/dev/null 2>&1 || true
     fi
     _bs_lib="$SHDEPS_DIR/shdeps.sh"
     _bs_dir="$SHDEPS_DIR"
@@ -1086,6 +922,10 @@ _bootstrap() {
     fi
   fi
 
+  if [[ -n "$_bs_dir" ]] && _is_release_install_dir "$_bs_dir"; then
+    _bs_release_install=1
+  fi
+
   # Bootstrap may discover a dev checkout that has not gone through install.sh
   # yet. Create the root binary link first so sourcing the Rust wrapper and
   # linking the CLI both target this checkout instead of an older PATH command.
@@ -1097,8 +937,12 @@ _bootstrap() {
   # shellcheck source=/dev/null
   . "$_bs_lib" || return 1
 
-  # Pull latest shdeps (skips dirty clones / active development)
-  if [[ -n "$_bs_dir" ]]; then
+  # Pull source checkouts during bootstrap, but keep release installs local.
+  # Release freshness checks can involve GitHub redirects or API calls; doing
+  # that before the caller has rendered any UI caused slow/noisy `dot update`
+  # startup during transient GitHub 504s. `SHDEPS_FORCE=1` still refreshes
+  # release installs above, which keeps explicit "check now" behavior.
+  if [[ -n "$_bs_dir" && "$_bs_release_install" -eq 0 ]]; then
     # Bootstrap is sourced into callers, so stdout belongs to the caller's
     # script. Self-update is opportunistic here and ignored on failure; keep it
     # quiet for the same reason so status chatter cannot pollute command

tests/shell/install-sh-test

@@ -80,103 +80,8 @@ export SHDEPS_INSTALL_SH_NO_DISPATCH
 source "$_repo_root/install.sh"
 unset SHDEPS_INSTALL_SH_NO_DISPATCH
 
-echo "=== install.sh: _natural_tag_cmp ==="
-
-# Date-prefixed YYYYMMDD-HHMMSS-hash tags: lexical and natural agree.
-_assert_eq "natural: same tag is eq" "eq" \
-  "$(_natural_tag_cmp '20260101-000000-abc' '20260101-000000-abc')"
-_assert_eq "natural: newer date prefix is gt" "gt" \
-  "$(_natural_tag_cmp '20260102-000000-abc' '20260101-000000-abc')"
-_assert_eq "natural: older date prefix is lt" "lt" \
-  "$(_natural_tag_cmp '20260100-000000-abc' '20260101-000000-abc')"
-
-# Multi-digit numeric components: lexical would order `v1.10` BEFORE
-# `v1.9` (wrong); natural order gives `v1.10` > `v1.9`. This is the
-# parity gap with the Rust `compare_tags` implementation.
-_assert_eq "natural: v1.10 is gt v1.9 (lexical would say lt)" "gt" \
-  "$(_natural_tag_cmp 'v1.10' 'v1.9')"
-_assert_eq "natural: v1.9 is lt v1.10" "lt" \
-  "$(_natural_tag_cmp 'v1.9' 'v1.10')"
-_assert_eq "natural: v2.0 is gt v1.99" "gt" \
-  "$(_natural_tag_cmp 'v2.0' 'v1.99')"
-
-# Leading zeros: 010 and 10 are equal numerically.
-_assert_eq "natural: leading-zero numeric equals" "eq" \
-  "$(_natural_tag_cmp 'v010' 'v10')"
-
-# `v10` parses as Text("v"), Number("10") and `vbeta` parses as
-# Text("vbeta"); the first comparison is Text("v") vs Text("vbeta")
-# which resolves lexicographically (shorter prefix loses), so
-# `v10` < `vbeta`. This is the documented Rust behavior — the
-# cross-class "Number > Text" rule only fires when the two tags differ
-# AT a Number-vs-Text boundary that is reached on both sides
-# simultaneously (i.e., earlier parts compared equal).
-_assert_eq "natural: differing first text runs decide before later parts" "lt" \
-  "$(_natural_tag_cmp 'v10' 'vbeta')"
-# Cross-class first runs: digit-first vs letter-first. This is the
-# canonical case where the "Number > Text" rule applies because the
-# parts compared at position 0 are different classes.
-_assert_eq "natural: digit-first beats letter-first (Number > Text)" "gt" \
-  "$(_natural_tag_cmp '1foo' 'afoo')"
-
-# Tag with extra suffix is greater than the prefix.
-_assert_eq "natural: longer-with-suffix is gt prefix" "gt" \
-  "$(_natural_tag_cmp 'v1.0.1' 'v1.0')"
-
-echo "=== install.sh: _release_tag_newer ==="
-
-_assert_true "newer tag returns success" \
-  _release_tag_newer "20260101-000000-abc" "20260100-000000-abc"
-_assert_false "same tag returns failure" \
-  _release_tag_newer "20260101-000000-abc" "20260101-000000-abc"
-_assert_false "older latest returns failure" \
-  _release_tag_newer "20260100-000000-abc" "20260101-000000-abc"
-_assert_false "empty latest returns failure" \
-  _release_tag_newer "" "20260101-000000-abc"
-_assert_true "newer tag with multi-digit minor returns success" \
-  _release_tag_newer "v1.10" "v1.9"
-
-echo "=== install.sh: _refresh_release_install_if_stale guards ==="
-
-# When the local install metadata is missing the `tag` field,
-# `_refresh_release_install_if_stale` must NOT trigger a re-install on
-# every shell startup. The pre-fix behavior fired `_install_release` on
-# every call because `_release_tag_newer "$latest" ""` returned true; the
-# guard inside the function short-circuits before the network step.
-_install_release_called=0
-_install_release() {
-  # Stub: record invocation so the test can assert it never ran.
-  _install_release_called=$((_install_release_called + 1))
-  return 0
-}
-_latest_release_tag() {
-  # Stub: pretend GitHub published a clearly-newer tag so any guard
-  # failure would manifest as a recorded `_install_release` call.
-  printf '20990101-000000-future\n'
-}
-_uses_default_repo_slug() { return 0; }
-_repo_slug() { printf 'owner/repo\n'; }
-
 _fixture_dir=$(mktemp -d)
 trap 'rm -rf "$_fixture_dir"' EXIT
-SHDEPS_DIR="$_fixture_dir/release-install"
-mkdir -p "$SHDEPS_DIR"
-touch "$SHDEPS_DIR/shdeps"
-# A `.shdeps-install.json` with only `method` (no `tag`) — mirrors the
-# corrupted-or-old state where the bug used to loop the download.
-printf '{"method": "release"}\n' >"$SHDEPS_DIR/.shdeps-install.json"
-
-_install_release_called=0
-_refresh_release_install_if_stale
-_assert_eq "missing tag does not fire install" "0" "$_install_release_called"
-
-# Sanity check: with a valid older `tag`, the function DOES fire the
-# install. This proves the guard is the only thing preventing the call.
-printf '{"method": "release", "tag": "20260101-000000-abc"}\n' \
-  >"$SHDEPS_DIR/.shdeps-install.json"
-_install_release_called=0
-_refresh_release_install_if_stale
-_assert_eq "stale tag fires install" "1" "$_install_release_called"
 
 echo "=== install.sh: _curl_config_quote ==="