End Protected-Root and Profile Matches at a Path Component on Windows - #4105

…Step (#4111)

## Summary

Answers CodeRabbit's review of promotion PR #4096 on the
`install-agents` scripts. The guiding rule is unchanged: run only a
command that upgrades exactly the tool's own package.

- **bun's directories.** `BUN_INSTALL` and `BUN_INSTALL_GLOBAL_DIR` are
honored on both platforms through one helper each: `bun_global_dir` on
Linux, `Get-BunDirectory` on Windows. A moved bun carries no `.bun`
segment, so it is recognized by these directories. On Windows that
includes the bin directory, where bun's copied shim sits.
`bunfig.toml`'s `install.globalDir` is deliberately not read.
- **mise (Linux).** mise's own listing is asked before any path shape,
so a tool under a relocated `MISE_DATA_DIR` reads as mise.
- **mise shims (Linux).** A command whose real path is the `mise`
executable is resolved through `mise which` before it is classified. So
a Homebrew-installed mise no longer leads to `brew upgrade mise`. A
failed lookup is reported, and nothing runs.
- **herdr post step.** One step, `herdr_after_upgrade` /
`Invoke-HerdrAfterUpgrade`, reinstalls herdr's integrations and gives
the restart guidance. It now runs after both the self-updater and a
successful manager upgrade.
- **Scoop roots (Windows).** With `SCOOP` or `SCOOP_GLOBAL` unset,
`Get-ScoopRoot` reads `root_path` and `global_path` from scoop's own
`config.json`, then falls back to the defaults.
- **Test.** The unwritable-npm test skips when run as root.

Two other CodeRabbit findings on #4096 were answered there. The
protected-root boundary was already fixed by #4105. Windows bun
shim-target ownership was declined with evidence.

## Verification

- `tests/test_install_agents.py` passes, including the PowerShell cases
under `pwsh`.
- The new tests cover each case, and the bun-relocation and mise-shim
tests fail on the previous code.
- shellcheck, shfmt, PSScriptAnalyzer and the prose gate are clean.
- Three recorded local passes ran. The last found nothing open.

## Pre-existing Findings, Not Filed

- `host-setup/linux/install-agents.sh` `manager_plan` (`pre-existing`,
from #4095): the Node-runtime exception covers only node. A tool
pip-installed into a mise-managed Python would get `mise upgrade
python`. Among the managed tools only cswap could reach it, and only if
installed with pip instead of the documented `uv tool install`.
- `host-setup/linux/install-agents.sh` (`pre-existing`, consolidation):
`mise_key` runs from both classification and the plan, so `mise ls
--json` runs twice per mise tool. It is harmless, and each run is
bounded by `timeout 30`.

## Not Verified

- Real package-manager installs, a `verification` gap. The tests use
stub managers and modeled layouts. Neither real bun, mise and scoop
installs, nor PowerShell's handling of their shims, has been exercised.
The maintainer's Windows 11 retest after this release covers the
npm-installed opencode case.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

… Dead Bound (#4112)

## Summary

Answers the attested local review of promotion PR #4096 at 6ba6179.
Copilot reached its round cap there, so the policy hands that head to an
attested local pass.

- **herdr report vs upgrade.** The report now shows herdr's
outdated-integration and restart notes for a manager-owned herdr too, on
both platforms, but only when the manager plan will run. That matches
the post step `--upgrade` runs since #4111.
- **`Hide-Home` in `install-tools.ps1`.** It had the unbounded profile
match that #4105 fixed only in `install-agents.ps1`, so it now gets the
same component boundary. The two copies are textually identical, as
`host-setup/README.md` requires, and a test holds them equal.
- **One path-containment helper.** The new `Test-PathUnder -Path -Root
[-Below]` in `install-agents.ps1` replaces seven hand-written "at or
under this root" checks, each of which normalized separators in its own
way. Behavior is unchanged, including a scoop root written with a
trailing separator or on an absent drive. `Hide-Home` stays
self-contained so its two copies remain identical.
- **`Resolve-FinalPath`.** Its depth bound and comment were dead code: a
link loop throws from `ResolveLinkTarget` first, and the threat model
rules out guarding against it. They are removed.

## Verification

- `tests/test_install_agents.py` passes, including the PowerShell cases
under `pwsh`. `tests/test_install_tools.py` and
`tests/test_cli_usage.py` pass too.
- New tests cover the manager-owned herdr notes, the identical
`Hide-Home` copies, `Test-PathUnder`, and a scoop root with a trailing
separator. The scoop-root test fails on the intermediate commit.
- shellcheck, shfmt, PSScriptAnalyzer and the prose gate are clean.
- Three recorded local passes ran. The last found nothing open.

## Not Verified

- Real package-manager installs, a `verification` gap. The pure path
helpers, `Test-PathUnder` included, run on the native Windows CI runner,
which passed on this head. Real scoop, bun and npm installs have not
been exercised. The maintainer's Windows 11 retest after this release
covers the npm-installed opencode case.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

… Upgrades (#4096)

## Summary

Promotes the agent-setup follow-ups and their review fixes, plus one
change from another hub session, from `develop` to `main`. Both follow a
native Windows 11 test of the one-step agent setup released as 2.0.1414.

- #4094:
- The Claude safety kit puts `"$defaults"` first in each `autoMode` list
that exists (`environment`, `allow`, `soft_deny`, `hard_deny`). Claude
Code's "learn rules" offer had written a list without it, which silently
replaced Claude Code's built-in rules. `--report` flags such a list as
not current.
  - The kit report's archive note names the commit.
- The Codex and opencode rules lines say when only an agent's config
directory makes it count as installed.
- `merge-and-release` step 7 also refreshes the Codex and opencode
rules, only where the kit reads current.
- #4095: an agent tool installed through npm, bun, scoop, Homebrew or
mise is upgraded through that manager, one package only. The manager is
asked whether it owns the tool, with every link resolved, before any
path shape is read, and the recorded package must own the file. A Node
runtime is never upgraded on an agent's behalf. Nothing elevates: choco,
a global scoop app, an unwritable npm prefix and Nix are reported with
their command. winget and apt stay with `upgrade-host`.

- #4102: answers this promotion's Copilot review. On Linux, npm is asked
before a `.bun` path, as on Windows, and a Nix agent under
`/nix/store/.../node_modules` is read as Nix before the generic npm
shape.

- #4105: answers this promotion's second Copilot round. On Windows,
`Test-ProtectedPath` and `Hide-Home` match only at a path component, so
`C:\Program FilesPortable` is no longer read as protected and a sibling
profile is no longer shortened. The pure path-helper tests now also run
on the native Windows CI runner.

- #4111: answers CodeRabbit's review of this promotion. bun's
`BUN_INSTALL` and `BUN_INSTALL_GLOBAL_DIR` are honored, including bun's
copied Windows shim. A mise shim is followed through `mise which`, and
mise's own listing is asked before any path shape. One herdr post step
runs after every successful upgrade. Scoop's configured roots are read
from its `config.json`.

- #4112: answers this promotion's attested local review. herdr's report
notes now match its post step for a manager-owned herdr.
`install-tools.ps1`'s `Hide-Home` gets #4105's component boundary. One
`Test-PathUnder` helper replaces seven hand-written containment checks.
A dead depth bound is removed.

- #4109, from another hub session: `dotnet-codestyle` now requires a
`global.json` pinning SDK `10.0.100` with `latestFeature` and
`allowPrerelease: false`. It leaves `LangVersion` unset (netstandard
generator projects excepted) and forbids `EnablePreviewFeatures`. The
audit gains the `csharp.sdk.globaljson` check, with a
`catalog/snippets/configs/global.json` snippet and its `spec/files.json`
C# baseline entry. `CODESTYLE.md`'s .NET summary line is updated.
Follow-ups #4106 and #4107 are filed and not in this promotion.

## Pre-existing Findings, Filed

- `host-setup/windows/install-tools.ps1:616` (`pre-existing`,
correctness): `Write-InstallFailure`'s profile replacement in log lines
does not stop at a path component. Filed as #4113.

## Not Verified

- Real package managers. #4095's tests use stub managers on PATH. The
Windows npm, scoop and bun layouts are modeled from their documented
formats and have not been run against real installs. The maintainer's
Windows 11 retest after this release covers the npm-installed opencode
case.

Closes #4103

🤖 Generated with [Claude Code](https://claude.com/claude-code)