pkg: address managed DNS mode review feedback

test-scripts/darwin/test-pkg-intercept-mode.sh

@@ -2,7 +2,7 @@
 set -eu
 
 repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
-postinstall="$repo_root/scripts/pkg/postinstall"
+postinstall_source="$repo_root/scripts/pkg/postinstall"
 fixture=$(mktemp -d "${TMPDIR:-/tmp}/ctrld-pkg-intercept.XXXXXX")
 trap 'rm -rf "$fixture"' EXIT HUP INT TERM
 
@@ -39,10 +39,12 @@ EOF
 cat >"$bin/ctrld" <<'EOF'
 #!/bin/sh
 printf 'ctrld %s\n' "$*" >>"$CALLS"
-case " $* " in
-    *" --cd-org="*) : >"$CTRLD_POSTINSTALL_PLIST" ;;
-esac
-exit 0
+if [ "${FAKE_CTRLD_EXIT:-0}" = "0" ]; then
+    case " $* " in
+        *" --cd-org="*) : >"$FAKE_PLIST" ;;
+    esac
+fi
+exit "${FAKE_CTRLD_EXIT:-0}"
 EOF
 
 chmod +x "$bin/defaults" "$bin/launchctl" "$bin/ctrld"
@@ -72,31 +74,49 @@ run_case() {
     existing=$2
     mode_present=$3
     mode=$4
+    ctrld_exit=${5:-0}
+    expected_status=${6:-0}
     case_dir="$fixture/$name"
     mkdir -p "$case_dir"
     plist="$case_dir/ctrld.plist"
     prefs="$case_dir/preferences"
     calls="$case_dir/calls"
     output="$case_dir/output"
+    postinstall="$case_dir/postinstall"
     : >"$calls"
     if [ "$existing" = "1" ]; then
         : >"$plist"
     fi
 
+    sed \
+        -e "s|^PLIST=\"/Library/LaunchDaemons/ctrld.plist\"$|PLIST=\"$plist\"|" \
+        -e "s|^CTRLD=\"/usr/local/bin/ctrld\"$|CTRLD=\"$bin/ctrld\"|" \
+        -e "s|^PREFS=\"/Library/Managed Preferences/com.controld.ctrld\"$|PREFS=\"$prefs\"|" \
+        "$postinstall_source" >"$postinstall"
+    chmod +x "$postinstall"
+
+    status=0
     PATH="$bin:$PATH" \
     CALLS="$calls" \
     FAKE_TOKEN_PRESENT=1 \
     FAKE_TOKEN=test-token \
     FAKE_MODE_PRESENT="$mode_present" \
     FAKE_MODE="$mode" \
-    CTRLD_POSTINSTALL_PLIST="$plist" \
-    CTRLD_POSTINSTALL_CTRLD="$bin/ctrld" \
-    CTRLD_POSTINSTALL_PREFS="$prefs" \
-    "$postinstall" >"$output" 2>&1
+    FAKE_CTRLD_EXIT="$ctrld_exit" \
+    FAKE_PLIST="$plist" \
+    "$postinstall" >"$output" 2>&1 || status=$?
+
+    if [ "$status" -ne "$expected_status" ]; then
+        printf 'FAIL: %s exited %s, want %s\n' "$name" "$status" "$expected_status" >&2
+        sed -n '1,120p' "$output" >&2
+        exit 1
+    fi
 
     printf '%s\n' "$case_dir"
 }
 
+assert_not_contains 'CTRLD_POSTINSTALL_' "$postinstall_source"
+
 case_dir=$(run_case fresh-legacy 0 0 '')
 assert_contains 'ctrld start --cd-org=test-token' "$case_dir/calls"
 assert_not_contains '--intercept-mode' "$case_dir/calls"
@@ -120,4 +140,18 @@ case_dir=$(run_case upgrade-intercept 1 1 intercept-dns)
 assert_contains 'ctrld start --intercept-mode dns' "$case_dir/calls"
 assert_not_contains 'launchctl load' "$case_dir/calls"
 
+case_dir=$(run_case fresh-invalid 0 1 invalid)
+assert_contains 'WARNING: unsupported InterceptMode in managed preferences; using standard mode' "$case_dir/output"
+assert_not_contains '--intercept-mode' "$case_dir/calls"
+
+case_dir=$(run_case upgrade-invalid 1 1 invalid)
+assert_contains 'WARNING: unsupported InterceptMode in managed preferences; preserving existing service mode' "$case_dir/output"
+assert_contains 'launchctl load' "$case_dir/calls"
+assert_not_contains 'ctrld start' "$case_dir/calls"
+
+case_dir=$(run_case upgrade-standard-failure 1 1 standard 1 1)
+assert_contains 'ctrld start --intercept-mode off' "$case_dir/calls"
+assert_contains 'ERROR: upgrade installed but managed InterceptMode could not be applied' "$case_dir/output"
+assert_not_contains 'launchctl load' "$case_dir/calls"
+
 printf 'PASS: pkg postinstall preserves legacy mode and applies standard/intercept-dns policy\n'