PLN-228: harden install.sh with bash guard, jq hard prereq, idempotent state detection, and BSD-portable stderr sanitizer

Builds on the earlier error-surfacing work to cover the remaining PLN-228
acceptance criteria and fix three bugs uncovered during end-to-end
verification on macOS.

Scope covered:

- AC-001, AC-006: marketplace idempotency via `claude plugin marketplace
  list --json`; re-run prints "Marketplace already registered: <name>"
  instead of re-running `add`.
- AC-007, AC-010: pre/post snapshots via `claude plugin list --json`
  classify each plugin as Installed / Updated / Already up to date, so
  the three states are distinguishable without parsing CLI stdout.
- AC-008: summary line now reports all three counts separately while
  preserving the failed count.
- AC-011: POSIX-portable `BASH_VERSION` guard at script top exits cleanly
  under dash/ash before any bash-only syntax runs. `sh install.sh` on
  macOS still passes because `/bin/sh` is bash in POSIX mode — documented
  as a known limitation in the script comments.
- AC-012: `jq` promoted from soft warn to hard prereq, with brew/apt
  install instructions printed before any marketplace or plugin ops.
- Per-run `${TMPDIR:-/tmp}/closedloop-install.XXXXXX` work dir cleaned up
  via EXIT trap for stderr capture and snapshot files.

Bugs fixed during verification:

- snapshot_version: add `|| true` so an empty grep match in the
  classification command substitution no longer trips `set -e`. Without
  this, a fresh install successfully installed all 6 plugins but
  errexited before printing any per-plugin status or the summary.
- UP_TO_DATE branch: emit `info "Already up to date: <plugin>"` so
  AC-007's third distinct message is actually visible on re-runs; the
  counter alone didn't satisfy the AC.
- sanitize_stderr: replace GNU-sed-only `\x1b` / `\x00-\x08` escapes
  with a literal ESC via bash ANSI-C quoting plus `tr` octal ranges so
  the function works under BSD sed (macOS). Previously it errored with
  "RE error: invalid character range" and silently swallowed the very
  CLI error AC-002/AC-004/AC-005 require to be shown.

Verified end-to-end on macOS (bash 3.2):

- Fresh install: 6× "Installed: <plugin>"; summary "6 installed, 0
  updated, 0 already up to date".
- Idempotent re-run: "Marketplace already registered: closedloop-ai",
  6× "Already up to date: <plugin>", summary "0 installed, 0 updated,
  6 already up to date".
- Bogus MARKETPLACE_SOURCE: underlying `claude` CLI error surfaced via
  sanitize_stderr (AC-005).
- `dash install.sh`: guard fires, exits 1 with the guidance message.
- `jq` hidden from PATH: preflight exits 1 with brew/apt instructions
  before any marketplace/plugin ops.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: peterulsteen

install.sh

@@ -10,6 +10,17 @@
 #   3. Installs all 6 plugins globally (user scope)
 #   4. Auto-update is enabled by default — plugins stay current automatically
 #
+# NOTE: The BASH_VERSION check below can be bypassed by setting the BASH_VERSION
+# env var before invoking under sh/dash (e.g. BASH_VERSION=x sh install.sh).
+# This is a known limitation: the guard is a best-effort hint, not a security boundary.
+if [ -z "${BASH_VERSION:-}" ]; then
+  printf 'Error: This script requires bash. Run: bash install.sh\n  or: curl -fsSL https://raw.githubusercontent.com/closedloop-ai/claude-plugins/main/install.sh | bash\n' >&2
+  exit 1
+fi
+if [[ "${BASH_VERSINFO[0]:-0}" -lt 3 || ("${BASH_VERSINFO[0]:-0}" -eq 3 && "${BASH_VERSINFO[1]:-0}" -lt 2) ]]; then
+  printf 'Error: Bash 3.2+ required (found %s)\n' "$BASH_VERSION" >&2
+  exit 1
+fi
 set -euo pipefail
 
 # ── Colors ───────────────────────────────────────────────────────────────────
@@ -20,17 +31,30 @@ BLUE='\033[0;34m'
 BOLD='\033[1m'
 NC='\033[0m'
 
-info()       { echo -e "${GREEN}[✓]${NC} $1"; }
-warn()       { echo -e "${YELLOW}[!]${NC} $1"; }
-err()        { echo -e "${RED}[✗]${NC} $1"; }
-step()       { echo -e "${BLUE}[→]${NC} ${BOLD}$1${NC}"; }
-strip_ansi() { echo "$1" | sed 's/\x1b\[[0-9;]*m//g'; }
+info()  { echo -e "${GREEN}[✓]${NC} $1"; }
+warn()  { echo -e "${YELLOW}[!]${NC} $1"; }
+err()   { echo -e "${RED}[✗]${NC} $1"; }
+step()  { echo -e "${BLUE}[→]${NC} ${BOLD}$1${NC}"; }
+snapshot_version() { grep -m1 "^$2 " "$1" 2>/dev/null | awk '{print $2}' || true; }
+sanitize_stderr()  {
+    # Strip ANSI color escapes, then drop non-printable control chars.
+    # Uses bash ANSI-C quoting for a literal ESC so this works under BSD sed (macOS)
+    # as well as GNU sed. `tr` with octal ranges is POSIX-portable across both.
+    local esc=$'\033'
+    sed "s/${esc}\[[0-9;]*[a-zA-Z]//g" "$1" | tr -d '\000-\010\013-\037\177' >&2
+}
 
 # ── Constants ────────────────────────────────────────────────────────────────
 MARKETPLACE_SOURCE="closedloop-ai/claude-plugins"
 MARKETPLACE_NAME="closedloop-ai"
 PLUGINS=(bootstrap code code-review judges platform self-learning)
 
+# ── Per-run working directory ────────────────────────────────────────────────
+WORK_DIR=$(mktemp -d "${TMPDIR:-/tmp}/closedloop-install.XXXXXX")
+chmod 700 "$WORK_DIR"
+_cleanup() { rm -rf "$WORK_DIR"; }
+trap _cleanup EXIT
+
 # ── Preflight checks ────────────────────────────────────────────────────────
 echo
 echo -e "${BOLD}ClosedLoop Claude Plugins Installer${NC}"
@@ -50,8 +74,8 @@ info "Claude Code CLI found: $(claude --version 2>/dev/null || echo 'unknown ver
 # Python 3.11+
 if command -v python3 &>/dev/null; then
     PY_VERSION=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
-    PY_MAJOR=$(echo "$PY_VERSION" | cut -d. -f1)
-    PY_MINOR=$(echo "$PY_VERSION" | cut -d. -f2)
+    PY_MAJOR="${PY_VERSION%%.*}"
+    PY_MINOR="${PY_VERSION##*.}"
     if [[ "$PY_MAJOR" -gt 3 || ( "$PY_MAJOR" -eq 3 && "$PY_MINOR" -ge 11 ) ]]; then
         info "Python $PY_VERSION"
     else
@@ -62,26 +86,31 @@ else
 fi
 
 # jq
-if command -v jq &>/dev/null; then
-    info "jq found"
+if ! command -v jq &>/dev/null; then
+    err "jq is required but not found."
+    echo "    Install: brew install jq  (macOS)"
+    echo "    Install: apt install jq   (Debian/Ubuntu)"
+    exit 1
 else
-    warn "jq not found — some plugin features require it"
-    echo "    Install: brew install jq (macOS) / apt install jq (Linux)"
+    info "jq found"
 fi
 
 echo
 
 # ── Add marketplace ─────────────────────────────────────────────────────────
 step "Registering closedloop-ai marketplace..."
 
-if MARKETPLACE_ERR=$(claude plugin marketplace add "$MARKETPLACE_SOURCE" 2>&1); then
-    info "Marketplace registered: $MARKETPLACE_SOURCE"
+_MARKETPLACE_LIST=$(claude plugin marketplace list --json 2>/dev/null)
+if [[ -n "$_MARKETPLACE_LIST" ]] \
+   && echo "$_MARKETPLACE_LIST" | jq -e --arg name "$MARKETPLACE_NAME" 'any(.name == $name)' &>/dev/null; then
+    info "Marketplace already registered: $MARKETPLACE_NAME"
 else
-    MARKETPLACE_ERR_CLEAN=$(strip_ansi "$MARKETPLACE_ERR")
-    if echo "$MARKETPLACE_ERR_CLEAN" | grep -qiE 'already|exists'; then
-        warn "Marketplace already registered: $MARKETPLACE_SOURCE (continuing)"
+    [[ -z "$_MARKETPLACE_LIST" ]] && warn "Could not query marketplace list — attempting add anyway"
+    if claude plugin marketplace add "$MARKETPLACE_SOURCE" 2>"$WORK_DIR/marketplace_err"; then
+        info "Marketplace registered: $MARKETPLACE_SOURCE"
     else
-        warn "Marketplace registration failed: $MARKETPLACE_ERR_CLEAN"
+        warn "Marketplace add failed:"
+        sanitize_stderr "$WORK_DIR/marketplace_err"
     fi
 fi
 
@@ -91,37 +120,62 @@ echo
 step "Installing plugins (user scope)..."
 
 INSTALLED=0
+UPDATED=0
+UP_TO_DATE=0
 FAILED=0
 
+SNAPSHOT_PRE="$WORK_DIR/snapshot_pre"
+SNAPSHOT_POST="$WORK_DIR/snapshot_post"
+STDERR_FILE="$WORK_DIR/install_err"
+
+claude plugin list --json 2>/dev/null \
+  | jq -r '.[] | .id + " " + .version' > "$SNAPSHOT_PRE" 2>/dev/null || true
+[[ -s "$SNAPSHOT_PRE" ]] || warn "Could not snapshot installed plugins — state detection will be approximate"
+
+SUCCESSFUL_PLUGINS=()
+
 for plugin in "${PLUGINS[@]}"; do
-    PLUGIN_REF="${plugin}@${MARKETPLACE_NAME}"
-    if INSTALL_ERR=$(claude plugin install "$PLUGIN_REF" --scope user 2>&1); then
-        info "Installed: $plugin"
+    plugin_ref="${plugin}@${MARKETPLACE_NAME}"
+    if claude plugin install "$plugin_ref" --scope user 2>"$STDERR_FILE"; then
+        SUCCESSFUL_PLUGINS+=("$plugin_ref")
+    # Install failed — may already exist; try update instead
+    elif claude plugin update "$plugin_ref" --scope user 2>"$STDERR_FILE"; then
+        SUCCESSFUL_PLUGINS+=("$plugin_ref")
+    else
+        [[ -s "$STDERR_FILE" ]] && sanitize_stderr "$STDERR_FILE"
+        warn "Could not install/update: $plugin"
+        FAILED=$((FAILED + 1))
+    fi
+done
+
+claude plugin list --json 2>/dev/null \
+  | jq -r '.[] | .id + " " + .version' > "$SNAPSHOT_POST" 2>/dev/null || true
+
+for plugin_ref in "${SUCCESSFUL_PLUGINS[@]+"${SUCCESSFUL_PLUGINS[@]}"}"; do
+    plugin="${plugin_ref%@*}"
+    pre_ver=$(snapshot_version "$SNAPSHOT_PRE" "$plugin_ref")
+    post_ver=$(snapshot_version "$SNAPSHOT_POST" "$plugin_ref")
+    if [[ -z "$pre_ver" || -z "$post_ver" ]]; then
         INSTALLED=$((INSTALLED + 1))
+        info "Installed: $plugin"
+    elif [[ "$pre_ver" == "$post_ver" ]]; then
+        UP_TO_DATE=$((UP_TO_DATE + 1))
+        info "Already up to date: $plugin"
     else
-        # May already be installed — try to update instead
-        if UPDATE_ERR=$(claude plugin update "$PLUGIN_REF" --scope user 2>&1); then
-            info "Updated: $plugin"
-            INSTALLED=$((INSTALLED + 1))
-        else
-            warn "Could not install/update: $plugin"
-            INSTALL_ERR_CLEAN=$(strip_ansi "$INSTALL_ERR")
-            UPDATE_ERR_CLEAN=$(strip_ansi "$UPDATE_ERR")
-            [[ -n "$INSTALL_ERR_CLEAN" ]] && warn "install: $INSTALL_ERR_CLEAN"
-            [[ -n "$UPDATE_ERR_CLEAN" ]] && warn "update: $UPDATE_ERR_CLEAN"
-            FAILED=$((FAILED + 1))
-        fi
+        UPDATED=$((UPDATED + 1))
+        info "Updated: $plugin ($pre_ver -> $post_ver)"
     fi
 done
 
 echo
 
 # ── Summary ──────────────────────────────────────────────────────────────────
+TOTAL=$((INSTALLED + UPDATED + UP_TO_DATE + FAILED))
 echo "────────────────────────────────────"
 if [[ $FAILED -eq 0 ]]; then
-    echo -e "${GREEN}${BOLD}All $INSTALLED plugins installed successfully!${NC}"
+    echo -e "${GREEN}${BOLD}All $TOTAL plugins ready ($INSTALLED installed, $UPDATED updated, $UP_TO_DATE already up to date).${NC}"
 else
-    echo -e "${YELLOW}${BOLD}$INSTALLED installed, $FAILED failed${NC}"
+    echo -e "${YELLOW}${BOLD}$TOTAL plugins processed: $INSTALLED installed, $UPDATED updated, $UP_TO_DATE already up to date, $FAILED failed.${NC}"
 fi
 
 echo