fix(cli): make bootstrap options explicit

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/install-sh-fixtures/npx

@@ -3,4 +3,4 @@ set -euo pipefail
 
 : "${PAPERCLIP_INSTALL_TEST_LOG:?PAPERCLIP_INSTALL_TEST_LOG is required}"
 node --version >"${PAPERCLIP_INSTALL_TEST_LOG}.node"
-printf '%s\n' "$@" >"$PAPERCLIP_INSTALL_TEST_LOG"
+printf '%s\n' "$@" >>"$PAPERCLIP_INSTALL_TEST_LOG"

scripts/install.sh

@@ -146,6 +146,10 @@ if [ "$CANARY" = "1" ] && [ -n "$VERSION" ]; then
   fail "--canary and --version cannot be used together"
 fi
 
+if [ -n "$REF" ] || [ -n "$REPO" ]; then
+  fail "git-ref installs are not available in this installer build; omit --ref and --repo"
+fi
+
 if [ ! -t 0 ] || [ ! -t 1 ]; then
   NO_PROMPT=1
 fi
@@ -339,12 +343,19 @@ INSTALL_ARGS=(install)
 
 log "Delegating to the Paperclip CLI"
 print_command npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}"
-npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}"
 
 if [ "$DRY_RUN" = "1" ]; then
   exit 0
 fi
 
+npx --yes "$PACKAGE_SPEC" "${INSTALL_ARGS[@]}"
+
+if [ "$INSTALL_SERVICE" = "1" ]; then
+  log "Installing the Paperclip service"
+  print_command npx --yes "$PACKAGE_SPEC" service install
+  npx --yes "$PACKAGE_SPEC" service install
+fi
+
 if [ "$NO_ONBOARD" = "0" ] && [ -t 0 ] && [ -t 1 ]; then
   if command -v paperclipai >/dev/null 2>&1; then
     exec paperclipai onboard

scripts/test-install-sh-docker.sh

@@ -70,21 +70,32 @@ assert_line "$RESULTS_DIR/with-node.args" "install"
 assert_line "$RESULTS_DIR/with-node.args" "--yes"
 
 echo "==> --ref master"
-run_with_node ref-master bash /paperclip-scripts/install.sh --ref master --no-onboard
-assert_no_line "$RESULTS_DIR/ref-master.args" "--ref"
-assert_no_line "$RESULTS_DIR/ref-master.args" "master"
+if run_with_node ref-master bash /paperclip-scripts/install.sh --ref master --no-onboard; then
+  echo "Expected --ref to fail until git-ref installation support is integrated" >&2
+  exit 1
+fi
+[ ! -e "$RESULTS_DIR/ref-master.args" ] || {
+  echo "Expected --ref failure before invoking npx" >&2
+  exit 1
+}
 
 echo "==> piped --no-prompt"
 run_with_node piped bash -c 'cat /paperclip-scripts/install.sh | bash -s -- --no-prompt --no-onboard'
 assert_line "$RESULTS_DIR/piped.args" "--yes"
 
+echo "==> dry run"
+run_with_node dry-run bash /paperclip-scripts/install.sh --dry-run --no-onboard
+[ ! -e "$RESULTS_DIR/dry-run.args" ] || {
+  echo "Expected --dry-run to avoid invoking npx" >&2
+  exit 1
+}
+
 echo "==> environment twins"
 docker run --rm \
   -v "$REPO_ROOT/scripts:/paperclip-scripts:ro" \
   -v "$RESULTS_DIR:/results" \
   -e PAPERCLIP_INSTALL_TEST_LOG=/results/env.args \
   -e PAPERCLIP_INSTALL_VERSION=2026.722.0 \
-  -e PAPERCLIP_INSTALL_REPO=example/paperclip \
   -e PAPERCLIP_INSTALL_INSTALL_SERVICE=1 \
   -e PAPERCLIP_INSTALL_NO_ONBOARD=1 \
   -e PATH="/paperclip-scripts/install-sh-fixtures:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
@@ -94,8 +105,8 @@ assert_line "$RESULTS_DIR/env.args" "paperclipai@2026.722.0"
 assert_line "$RESULTS_DIR/env.args" "--version"
 assert_line "$RESULTS_DIR/env.args" "2026.722.0"
 assert_no_line "$RESULTS_DIR/env.args" "--repo"
-assert_no_line "$RESULTS_DIR/env.args" "example/paperclip"
 assert_no_line "$RESULTS_DIR/env.args" "--install-service"
+assert_line "$RESULTS_DIR/env.args" "service"
 
 echo "==> no Node, apt bootstrap"
 docker run --rm \