[JacobStephens2]

Summary

thirdshift console install can now save its script in one step, and setup names that step once the Console is enabled.

 thirdshift console install
-  print script                      # owner had to redirect or paste it
+  [--output <file>]
+    build script                    # unusable settings: error, no file written
+    write <file>                    # replaces an earlier copy
+    say "Wrote <file>. Read it, then run: sudo sh <file>"   # POSIX-quoted
+  (no flag) print script            # unchanged

 thirdshift setup → Console: yes
-  "To install the Console, run `thirdshift console install`; it prints a script to run with sudo."
+  "To install the Console, run `thirdshift console install --output install-console.sh`, read the script, then run `sudo sh install-console.sh`."

The script's header no longer names install-console.sh, so a script saved under another name doesn't tell its reader to run a different file. The README, thirdshift help and the usage line describe the flag.

Evidence

• Before: thirdshift console install --output install-console.sh was rejected with the usage line. On the first commit, the reviewers' test output_names_a_copyable_sudo_command_for_a_spaced_path failed:
  Wrote my script.sh. Read it, then run: sudo sh my script.sh
  After: cargo test --test console_install passes 13 of 13, including:

  output_saves_the_printed_script_and_names_the_sudo_command
    file == the printed script; stdout empty; stderr names "sudo sh install-console.sh"
    a stale file is replaced
  output_saves_nothing_when_the_settings_are_unusable
    blank console.address → failure, no file
  output_needs_a_file_name
    --output, --output --output, --json → usage "install [--output <file>]"
  output_names_a_copyable_sudo_command_for_a_spaced_path
    "my script.sh" → "sudo sh 'my script.sh'"; header names no other file
  

  tests/setup.rs now asserts that setup names thirdshift console install --output install-console.sh. The full cargo test suite passes: 2208 passed, 0 failed.

Merge Danger

Door: two-way

A new, optional flag; the plain command still prints the same script. The only change to the printed script is its first comment line.

Blast Radius: small

Owners who follow the setup hint get a file written to the current directory, replacing any file of that name.

Review coverage

Both the Standards and Spec reviewers read every changed file. Unread changed files: none. Generated-output exclusions: none.

Unaddressed findings

Standards

• Possible Middle Man: install_to is install(), a write and a message (src/console/install.rs, install_to). The reviewer called it acceptable: it keeps the file I/O and the owner-facing next step in the module that owns Console installation (docs/code-navigation.md, Console installation row). Moving it into main.rs would split that.
• Default file name install-console.sh repeated. Its one stale-making use, the script header, was removed. The name that remains in source is the single setup hint in src/setup.rs offer_console_install; the README and tests use it as an example. A shared constant would serve one source use.
• --json case in output_needs_a_file_name is an unknown-argument check, not an --output one. The reviewer called it harmless. It checks that the usage line is shown for an argument install doesn't take.
• Possible Primitive Obsession on output: Option<String> and Duplicated Code in the install --output match arm. The reviewer suppressed both under house convention: ConsoleThemeImport(String) and the password --email arm in src/args.rs have the same shapes.

Spec

None. Both Spec findings were addressed: the sudo command is quoted, and the module comment now says "prints or saves a script".

Closes #916

🤖 Generated with Claude Code

Built with claude · claude-opus-5-5 · medium

Security review outcome

No unaddressed introduced findings.