fix(installer): block piped privileged bootstrap

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/install.sh

@@ -20,6 +20,11 @@ INSTALL_SERVICE=0
 DRY_RUN=0
 VERBOSE=0
 TEMP_DIR=""
+PIPED_INSTALL=0
+
+if [ -z "${BASH_SOURCE[0]:-}" ] || [ ! -f "${BASH_SOURCE[0]}" ]; then
+  PIPED_INSTALL=1
+fi
 
 usage() {
   cat <<'EOF'
@@ -335,6 +340,9 @@ else
   else
     log "Node.js was not found"
   fi
+  if [ "$PIPED_INSTALL" = "1" ]; then
+    fail "Node.js bootstrap is disabled for piped installs; download install.sh, review it, and run 'bash install.sh --no-prompt'"
+  fi
   check_version_manager
   log "Installing Node.js $DEFAULT_NODE_MAJOR"
   if [ "$OS_NAME" = "macos" ]; then

scripts/test-install-sh-docker.sh

@@ -111,6 +111,18 @@ echo "==> piped --no-prompt"
 run_with_node piped bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-prompt --no-onboard'
 assert_line "$RESULTS_DIR/piped.args" "--yes"
 
+echo "==> piped mode refuses privileged Node bootstrap"
+if docker run --rm \
+  -v "$REPO_ROOT/scripts:/paperclip-scripts:ro" \
+  -e PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
+  ubuntu:24.04 \
+  bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-prompt --no-onboard' \
+  >"$RESULTS_DIR/piped-no-node.out" 2>&1; then
+  echo "Expected piped install without Node.js to fail before privileged bootstrap" >&2
+  exit 1
+fi
+assert_line "$RESULTS_DIR/piped-no-node.out" "[paperclip] error: Node.js bootstrap is disabled for piped installs; download install.sh, review it, and run 'bash install.sh --no-prompt'"
+
 echo "==> dry run"
 run_with_node dry-run bash /paperclip-scripts/install.sh --no-prompt --dry-run --no-onboard
 [ ! -e "$RESULTS_DIR/dry-run.args" ] || {