openRepoShape: --version and two fetch refusals print $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF with no check, so an escape or a bidi override in either reaches the terminal as typed, and a scaffold run sends its fetch with them #866

Goal: the openRepoShape launcher checks $OPENREPOSHAPE_REPO and $OPENREPOSHAPE_REF once, before --version answers and before any fetch. Then no line it prints holds either value with a control character or a character a terminal draws as another, and no request is sent with one.

Filed by lane openRepoShape-2 on Brett Heap's word ("file it", 2026-10-18T01:07:11Z).

• Source: rv841, lane 2's re-verification of install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841 (install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding a bidi override, U+200B, U+2028 or U+FEFF passes #804's control-character check and is echoed as typed, so the PATH note can show a directory as another #837), ruled this "a follow-up issue, not install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841". install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841's body lists it under "Not changed".
• Why it is not install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding a bidi override, U+200B, U+2028 or U+FEFF passes #804's control-character check and is echoed as typed, so the PATH note can show a directory as another #837's: install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding a bidi override, U+200B, U+2028 or U+FEFF passes #804's control-character check and is echoed as typed, so the PATH note can show a directory as another #837 is about the [![:print:]] checks letting format characters through. These three places have no check at all, so they let C0 and C1 controls through too, which is install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR holding : or a newline is refused by install.sh only after its fetch, and one holding a carriage return or an escape is placed and echoed as typed, so both refuse every control character before they fetch or print anything #760's ground. The fix also has another shape: one check up front.

Lands after: lane 2's #837 (PR #841, fix/837-bin-dir-format-chars, head f2483cf1).

• install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841 adds misdrawn_characters, and uses it in shape_checkout's $OPENREPOSHAPE_REPO check and in ref_fault. The up-front check should call both.
• path:line is at main b9b70692, with install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841's head in brackets.

Lines

• --version prints both values as typed and exits 0.
  • The line is openRepoShape:877 [:1003]: --version) refuse_bad_record; say "openRepoShape ($REPO @ $REF)"; exit 0 ;;.
  • Measured at both commits (bash 5.2.21, env -i, LANG=C.UTF-8):
    • with OPENREPOSHAPE_REPO set to acme/r, U+202E, x;
    • and OPENREPOSHAPE_REF set to v1, ESC, [31mX.
  • The output is openRepoShape (acme/r, the bytes E2 80 AE, x @ v1, the byte 1B, [31mX), and the exit is 0.
  • In a terminal, U+202E reverses how the text after it is drawn, and the escape turns the rest of the line red. This was not run in a terminal emulator here.
• A scaffold run sends its fetch with both values, and its refusal names them as typed.
  • fetch_or_die (:234 [:234]) puts $REPO and $REF into the gh api path and into the raw.githubusercontent.com URL. Its refusal prints each value three times.
  • Nothing checks either value before the fetch at :1078 [:1204].
  • Measured with a stub gh and a stub curl first on PATH, both failing:
    • openRepoShape Atlas --org acme printed REFUSED: could not fetch setup.sh from acme/r, E2 80 AE, x at v1, 1B, [31mX. Both ways failed:;
    • then both command lines, with the same bytes;
    • then it exited 2.
• --install's refusal for a failed fetch names both values as typed.
  • The refusal is in collect_commands (:280; the refusal at :301 [same]).
  • --install checks $REF first only when it records it ([ "$recording" -eq 0 ] || checked_ref "$REF", :528 [:633]). It never checks $REPO.
  • Measured with the same stubs: --install printed REFUSED: could not fetch openRepoShape from acme/r, E2 80 AE, x at v1, 1B, [31mX, so NOTHING was installed, and exited 2.

What is checked today

• shape_checkout (:610 [:722]) is --doctor's clone.
  • It refuses a $REPO that starts with - or holds a control character. At install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841's head it also refuses a character that misdrawn_characters names.
  • It runs checked_ref "$REF".
• --install runs checked_ref when it records.
• Every other line that prints either value runs after one of those (install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841's body).
• install.sh checks both values before it uses them: checked_repo at install.sh:126 [:131] and checked_version at :144 [:155]. So this issue is the launcher alone.

Direction

• Check both values once, right after the arguments are read, beside refuse_bad_record (:986 [:1112]).
  • Use shape_checkout's rule and words for $OPENREPOSHAPE_REPO, and checked_ref's for $OPENREPOSHAPE_REF, misdrawn_characters included.
  • Every later place then prints only a checked value. shape_checkout's own check can stay as a second guard, or go.
• Decide whether --version refuses with exit 2, as the other two places already do, or answers with a spelling that cannot be misdrawn. Say why.
• --help names the variables and never their values, so it can keep answering first.
• docs/cli.md:168 says "--version prints the ref in force". That stays true for every value the check passes.

Verify

• tests/test_openreposhape_command.py, tests/test_install_sh.py and tests/test_openreposhape_package.py pass on Linux.
• New cases, beside install.sh and openRepoShape: both refuse a $OPENREPOSHAPE_BIN_DIR holding a control character before they name it, and install.sh refuses a : before its fetch, so a carriage return or an escape is no longer echoed as typed (#760) #804's C1_BIN_DIRS and install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841's characters:
  • for each of --version, a scaffold run and --install;
  • for each of the two variables;
  • under C and C.UTF-8;
  • with a C0 control, a C1 control, U+202E and U+200B.
• Each case:
  • is refused with exit 2 before any request (the fake gh and curl are never called);
  • has no output that holds the raw value.
• A clean pair still prints openRepoShape (opensoft/openRepoShape @ main).
• Mutants: one per check, each killed.

Overlaps

• install.sh and openRepoShape: a $OPENREPOSHAPE_BIN_DIR, the repository or a ref holding a bidi control, a character of no width, a soft hyphen or U+2028 is refused by its code point before any request and never echoed, so no line shows the value as another #841 and install.sh and openRepoShape: the control-character check matches bytes, so a GBK or GB18030 name holding 0xC2 and a byte from 0x80 to 0x9F is refused as a control, and a lone 0x9B, which an 8-bit terminal acts on, is placed #858 also edit openRepoShape. install.sh and openRepoShape: the control-character check matches bytes, so a GBK or GB18030 name holding 0xC2 and a byte from 0x80 to 0x9F is refused as a control, and a lone 0x9B, which an 8-bit terminal acts on, is placed #858 is lane 2's, claimed at 2026-10-18T00:52:58Z, with a writer at work.
• No other open PR touches the file (checked at 2026-10-18T01:11Z). Whichever of install.sh and openRepoShape: the control-character check matches bytes, so a GBK or GB18030 name holding 0xC2 and a byte from 0x80 to 0x9F is refused as a control, and a lone 0x9B, which an 8-bit terminal acts on, is placed #858 and this lands second merges the other.
• The launcher is not a pinned shape copy, so no upstream-changed row follows.

Parent: #461.

Milestone: v1.1.1. Each line needs a value that the person set in their own environment. It is not a regression, and --doctor's clone already refuses the same values.

🤖 Generated with Claude Code