Reject a Dash-Prefixed Agents Name in Both Bootstrap Loaders

[ptr727]

Fixes #3129

bootstrap.ps1 -Agents and bootstrap.sh --agents now refuse any tool name that starts with a dash before the handoff to install-agents, with an error and a nonzero exit. Without it, pwsh -File binds -All or -a as a parameter of install-agents.ps1 (and --all is read as an option by install-agents.sh), installing every tool.

• bash: refused during argument parsing, per comma-separated name, before anything runs.
• PowerShell: refused in Invoke-AgentsInstall over every split name, for ASCII hyphen and also U+2013, U+2014, U+2015, which PowerShell binds as a parameter prefix (autocorrected paste). The check runs after the tree fetch, as the empty-list check does.
• Tests: one per loader in tests/test_bootstrap.py. Revert proof: with both loaders restored to develop, all subtests of both new tests fail; with the fix they pass.
• Local review: two passes. Pass 1 found the typographic-dash bypass (fixed). Pass 2 found no code defect and one test gap (U+2015 case), added after the pass as a one-line test-only commit, so the recorded receipt covers that line unreviewed.

Windows native verification (5.1 and 7) is left to the maintainer.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9f3fe1b9-bee3-4b31-9a61-d7c93df1c347

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

Add an assertion proving rejected inputs do not trigger the fetch.

1 open finding

• Assert parse-time rejection occurs before fetch · New

What changed in this PR

Adds validation to reject dash-prefixed agent names before installer handoff.

Changes:

• Validates ASCII and typographic dash prefixes in both loaders.
• Adds regression tests for rejected names.

File	Reviewed changes
tests/​test_bootstrap.py	Adds loader rejection tests; should also assert rejection occurs before fetching.
host-setup/​bootstrap.sh	Validates agent names during argument parsing.
host-setup/​bootstrap.ps1	Validates ASCII and typographic dash prefixes before installation.

🧠 Review effort: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

A recorded local strict-review pass covers head 27296acdee90431a3ab2a1aca56eeb25beb55ec4, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@f8faecc). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #3156   +/-   ##
==========================================
  Coverage           ?   63.97%           
==========================================
  Files              ?       17           
  Lines              ?     9151           
  Branches           ?        0           
==========================================
  Hits               ?     5854           
  Misses             ?     3297           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	63.97% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.