pastilhasandClaude Opus 5
52b021bbe2
Answering 11's question: provisionClaudeCli ran for the first time anywhere and did not work.
Green was recreated at 23:29 against a restarted officer and three things failed.
The installer is bash and the pipe is dash. os-user-claude.ts:77 runs `curl … | sh`, which
ignores the script's #!/bin/bash and hands bash-only syntax to dash — /bin/sh is dash on
Ubuntu. Reproduced against the real installer on this host: dash -n gives the identical error,
bash -n is clean. scripts/setup.sh:858 carries the same line.
~/.local is created root:root. os-user.ts:398's `install -d -o -g -m 711 …/.local/dockers`
creates the missing parent but applies ownership only to the final component — the same defect
71589aee found for .config and fixed by creating the parent explicitly. Rootless Docker never
started because dockerd, running as the member, could not mkdir inside the member's own
.local. And it blocks Claude too: the installer targets ~/.local/bin, so fixing the shell
alone gets further and then fails on permissions. Two stacked bugs, the same shape as the PG18
mount point sitting in front of the ACL denial earlier.
The file browser cannot read a member's home. Access mask is --- with both named entries
clamped, and ls as the service user is denied. The setfacl worked: default:mask is rwx while
the access mask is ---, and chmod recomputes the access mask and never the default, so a chmod
ran afterwards and flattened one side. The primitive tests correct in isolation, so this is a
reintroduction of the hazard the comment at :361 already warns about.
Also corrected 11's deprovision plan, which has userdel before chown -R. The spec puts the
sever first for a reason: userdel frees the uid and the subuid range, so doing it while files
still carry that uid means any failure leaves exactly the state the function exists to
prevent. Reversed, the worst case is an account that still exists.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>