fix: pre-landing review fixes (GST-743: key --project by its git toplevel, refuse a non-directory before cloning, ignore CDPATH)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

bin/gstack-capy-install

@@ -70,6 +70,7 @@ while [ $# -gt 0 ]; do
 done
 [ -n "$FOR" ] && [ -n "$REQUIRE" ] && { echo "gstack-capy-install: --for and --require are exclusive" >&2; exit 2; }
 [ -z "$FOR" ] && [ -z "$REQUIRE" ] && REQUIRE="claude,codex,patch"
+[ -z "$PROJECT" ] || [ -d "$PROJECT" ] || { echo "gstack-capy-install: --project takes a directory path; '$PROJECT' is not a directory (pass the project checkout's path, not a repo slug)" >&2; exit 2; }
 
 say() { echo "gstack-capy-install: $*"; }
 stop() { # CODE MESSAGE FIX — print and exit 3 before ./setup
@@ -148,8 +149,7 @@ STORE=$(gstack_bun_store "$GSTACK_STATE_ROOT")
 done
 INSTALL_VERSION=$(gstack_bun_install_version) || stop BUN_INSTALL_VERSION_INVALID "GSTACK_BUN_INSTALL_VERSION=$INSTALL_VERSION is not a verified Bun at or above gstack's supported minimum $GSTACK_BUN_TESTED (verified archives: $GSTACK_BUN_VERIFIED)" "unset GSTACK_BUN_INSTALL_VERSION, or set it to one of: $GSTACK_BUN_VERIFIED"
 [ -n "$PROJECT" ] || { PROJECT=$(cd "$ORIG_PWD" && git rev-parse --show-toplevel 2>/dev/null || true); [ "$(cd "${PROJECT:-/nonexistent}" 2>/dev/null && pwd -P)" = "$ROOT_REAL" ] && PROJECT=""; }
-PROJECT_REAL=""; [ -n "$PROJECT" ] && PROJECT_REAL=$(cd "$PROJECT" 2>/dev/null && pwd -P)
-[ -n "$PROJECT" ] && [ -z "$PROJECT_REAL" ] && { echo "gstack-capy-install: --project takes a directory path; '$PROJECT' is not a directory (pass the project checkout's path, not a repo slug)" >&2; exit 2; }
+PROJECT_REAL=""; [ -n "$PROJECT" ] && PROJECT_REAL=$(CDPATH= cd -- "$PROJECT" 2>/dev/null && gstack_install_project "$ROOT_REAL")
 VERDICT=$(gstack_install_verdict_path "$GSTACK_STATE_ROOT" "$ROOT_REAL" "$PROJECT_REAL")
 REC_BUN="" REC_VER="" REC_RULE="" REC_BUN_INSTALL="" REC_FOR=""
 if [ -f "$VERDICT" ]; then

changelog.d/gst-743-install-project-path.md

@@ -1 +1 @@
-- `install.sh --project` (through `gstack-capy-install`) refuses a value that is not a directory, such as a repo slug, with a usage error that asks for the checkout's path. Before, a slug silently keyed the install verdict and launch file to no project, so a later pregate admission check read a stale verdict (GST-743).
+- `install.sh --project` (through `gstack-capy-install`) keys the install verdict the way pregate admission reads it: by the project's git toplevel, so `--project <repo>/<subdir>` and `--project <repo>` write the same verdict. A value that is not a directory, such as a repo slug, is a usage error that asks for the checkout's path, raised before anything is cloned or installed. Before, a slug or a subdirectory keyed the verdict somewhere admission never looks, so a later pregate admission check read a stale verdict (GST-743).

test/gstack-capy-install.test.ts

@@ -167,6 +167,19 @@ describe('gstack-capy-install', () => {
     expect(fs.existsSync(path.join(f.home, '.gstack-state/install-verdicts'))).toBe(false);
   });
 
+  // Value: protects=the installer keys the verdict by the project's git toplevel, the key pregate admission reads (lib/install-verdict.ts installProject);
+  //   fails_when=--project <repo>/<subdir> writes a verdict at the subdirectory's key, which admission never reads; seam=bin/gstack-capy-install --project
+  test('--project names a subdirectory: the verdict is keyed by its git toplevel, the same file --project <toplevel> writes', () => {
+    const f = fixture();
+    const project = path.join(f.base, 'proj');
+    fs.mkdirSync(path.join(project, 'packages/x'), { recursive: true });
+    sh('git init -q', project);
+    const verdictOf = (r: { stdout: string; status: number | null; stderr: string }) => { expect(r.status, r.stdout + r.stderr).toBe(0); return r.stdout.match(/GSTACK_INSTALL_VERDICT=(\S+)/)![1]!; };
+    const sub = verdictOf(run(f, ['--for', 'autoplan', '--project', path.join(project, 'packages/x')]));
+    expect(sub).toBe(verdictOf(run(f, ['--for', 'autoplan', '--project', project])));
+    expect(JSON.parse(fs.readFileSync(sub, 'utf8')).project).toBe(fs.realpathSync(project));
+  });
+
   test('preflight: a missing tool stops with exit 3 and INSTALL_PREFLIGHT_FAILED before ./setup runs', () => {
     const f = fixture({ jq: false });
     const r = run(f);