[ccf-lisa]

Task: install.sh ignores every y/n answer (lead brief, 2026-10-28).

The bug

Running v0.2.1's install.sh on a host that already has agent.yaml and a refresh token, "Replace it? [y/N]" kept the config whatever was typed, and nothing else was asked.

confirm() declares local answer and calls ask answer …. ask() also declares a local answer, so its printf -v "$var" (with var=answer) set ask's own local. confirm always saw an empty answer, which meant its default every time:

• "Replace it? [y/N]" was always no, so the config was never replaced. With the host enrolled, nothing else was asked. That is what was seen.
• "Write it? [Y/n]" was always yes, so an "n" still wrote the config.
• Both model-login offers were always no.

setting (ask v) and the token prompts (ask token, ask claude_token) didn't hit this, but any caller whose variable matched one of ask's local names would have.

The fix

ask()'s locals are now _ask_var _ask_prompt _ask_silent _ask_reply, names no caller uses, and one comment line says why. I checked every ask caller: confirm (answer, the bug), setting (v), token, claude_token.

The test seam

• The prompts read ${FACTORY_INSTALL_TTY:-/dev/tty}. The comment saying it is for installsh_test.go comes after set -euo, so --help doesn't print it.
• The first ask opens it once, on fd 9, so a file of answers is read line by line. The fd is fixed rather than exec {fd}< because macOS's /bin/bash is 3.2.
• have_tty checks the same path, or the fd once it is open.
• host init's stdin is the same path (<"$tty") instead of a literal /dev/tty. Otherwise a test run without a controlling terminal would fail on the redirect. In real use it is the same /dev/tty.
• After a silent read, the newline now goes to stderr, where read -p prints the prompt, instead of /dev/tty. So nothing in the seam touches /dev/tty.

TestInstallScriptAsks in cmd/factory-agent/installsh_test.go uses a temp HOME with an agent.yaml and a refresh token, the existing fail-loud stubs, no --quiet and a file of answers:

• replaced: y to Replace, a dispatcher and Enter for the other 13 settings, y to Write, then Enter for both logins. The config is replaced, a .bak-… copy holds the old one, and the new one loads with config.Load (with the defaults). host init runs without --yes and no login runs.
• kept (n) and kept on Enter, both --dry-run: the config is untouched and there is no backup.
• not written: y to Replace, the settings, then n to Write. The script fails with "not written; nothing was changed", and the config is untouched with no backup.

The test never reaches the network or the real HOME.

Verification

• Without the fix (ask's local renamed back to answer, seam kept), replaced and not written fail: both exit 0 and keep the config. With the fix they pass. The kept cases pass either way, as they should, since "no" was the buggy answer too.
• go build ./... and GOOS=linux go build ./... pass.
• test -z "$(gofmt -l internal cmd api)" passes.
• shellcheck deploy/install.sh is clean.
• go test ./cmd/factory-agent -run TestInstallScript passes.
• make -k reviewable: lint has 0 issues, openapi lint passes, catalog checks pass and every test package passes, except the known local macOS failure internal/agent/host/provision TestBaseScriptRuns.

Self-review

One lenient pass with ccf-review core+go: approve. One nit, deferred and recorded in the lisa-selfreview note: fd 9 stays open for later commands. None of them reads it, and launchd/systemd don't pass it to supervise.

Dropped, with reasons

None.

🤖 Generated with Claude Code

[gusfcarvalho]

ccf-review: APPROVE

no findings.