fix(installer): harden dry runs and unit escaping

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cli/src/__tests__/service-manager.test.ts

@@ -37,6 +37,17 @@ describe("service definition generation", () => {
     expect(unit).not.toContain("API_KEY");
   });
 
+  it("escapes systemd variable and specifier expansion in configured values", () => {
+    const unit = renderSystemdUnit({
+      instanceId: "team-$USER-%i",
+      shimPath: "/home/$USER/%i/paperclipai",
+      homeDir: "/home/$USER/%i/.paperclip",
+    });
+
+    expect(unit).toContain('ExecStart="/home/$$USER/%%i/paperclipai" run --instance "team-$$USER-%%i"');
+    expect(unit).toContain('Environment="PAPERCLIP_HOME=/home/$$USER/%%i/.paperclip"');
+  });
+
   it("generates a launchd agent with keepalive and instance logs", () => {
     const plist = renderLaunchdPlist({ instanceId: "team-a", shimPath: "/Users/alice/.local/bin/paperclipai", homeDir: "/Users/alice/.paperclip", stdoutPath: "/Users/alice/.paperclip/instances/team-a/logs/service.log", stderrPath: "/Users/alice/.paperclip/instances/team-a/logs/service.err.log" });
     expect(plist).toContain("ing.paperclip.paperclipai.team-a");

cli/src/services/service-manager.ts

@@ -53,7 +53,11 @@ export const defaultCommandRunner: CommandRunner = async (command, args, options
 };
 
 function escapeSystemd(value: string): string {
-  return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+  return value
+    .replaceAll("\\", "\\\\")
+    .replaceAll('"', '\\"')
+    .replaceAll("$", () => "$$")
+    .replaceAll("%", "%%");
 }
 
 function escapeXml(value: string): string {

scripts/install.sh

@@ -354,15 +354,16 @@ INSTALL_ARGS=(install)
 [ "$CANARY" = "1" ] && INSTALL_ARGS+=(--canary)
 [ -n "$VERSION" ] && INSTALL_ARGS+=(--version "$VERSION")
 [ "$NO_PROMPT" = "1" ] && INSTALL_ARGS+=(--yes)
+INSTALL_COMMAND=(npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}")
 
 log "Delegating to the Paperclip CLI"
-print_command npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}"
-
 if [ "$DRY_RUN" = "1" ]; then
+  print_command "${INSTALL_COMMAND[@]}"
   exit 0
 fi
 
-npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}"
+print_command "${INSTALL_COMMAND[@]}"
+"${INSTALL_COMMAND[@]}"
 
 if [ "$INSTALL_SERVICE" = "1" ]; then
   log "Installing the Paperclip service"