fix(cli-registry): address maintainer review on #380

Rebased onto current master (the one real conflict was the import line
in docker-hosts.ts Ark0N flagged; kept both), then addressed every
point from the review:

**1. Rebase.** Done — this branch now sits on current upstream/master.

**2. Agent-image special cases are data now, not an id-keyed table
outside stock.ts.** `AGENT_IMAGE_SPECIAL_CASE_IDS`/`AGENT_IMAGE_SPECIAL_CASES`
are gone. `CliDiscovery.install.agentImageLayer?: { kind: 'dedicated';
reason: string }` is a field on the registry entry itself (pi,
deepseek), `reason` is required by schema.ts, both producers
(docker-hosts.ts and cli-catalog.mjs) filter on its presence instead
of an id, and the coverage test reads it from the generated catalogue.
Also added the npm-package-name validation to the TS producer, which
only the .mjs one had — same SAFE_PACKAGE regex, duplicated
(necessarily, one side can't import the other) and now pinned
byte-identical by a new parity test.

**3. Changeset said five, it's eight.** (Not nine — see the DeepSeek
point below, which changes the true count.) Reworded to state it
structurally rather than pin a number that will go stale again.

Then the four behavior-changing findings:

- **DeepSeek was offered as a normal install option but can't actually
  drive a pane.** `npm install -g @deepseek-ai/dsh` installs the
  launcher only; DeepSeek ships no profile that can run standalone.
  The generator now emits an empty install command for any
  `launcherProfile` entry, so install.sh's menu (which requires a
  non-empty command) skips it and falls through to its docs URL hint
  instead — matching what the old hand-written code did before this
  PR replaced it.
- **wget-only hosts lost every automatic install, including the npm
  ones that never needed curl.** The menu-building loop now filters
  PER ENTRY (only a command starting with `curl ` is held back) rather
  than wiping the whole menu when DOWNLOADER != curl.
- **The DISPLAY/TRUSTED split and the catalogue refresh didn't hold up
  under review** (refresh's only real write was the label; it ran
  before the Node existence check; its own eval-detection test was
  tripped by the word "eval'd" in a comment). Dropped entirely per
  your own recommendation — embedded catalogue only, no network
  fetch, no second array. install-sh-invariants.test.ts now asserts
  the refresh/DISPLAY machinery does not exist rather than testing its
  internals.

The three take-or-leave items, applied:

- `dsh_banner_probe`'s bash 3.2 empty-array bug: `${runner[@]}` →
  `${runner[@]+"${runner[@]}"}`. Verified live in a real `bash:3.2.57`
  container with `timeout` removed from PATH — crashed before, clean
  now, full `detect_all_clis` path exercised end to end.
- `docker-agent-image-coverage.test.ts` now anchors on each layer's
  `<binary> --version` proof line instead of `Dockerfile.includes(binary)`,
  which stayed true if a layer were deleted but its comment survived.
- Doc drift: docs/docker-cases.md (four → five, and now describes the
  data field), docker/agent.Dockerfile's "other four CLIs" comment (no
  longer a magic number — CLI_NPM_PACKAGES is generated and can grow),
  CLAUDE.md's install.sh size (104KB → ~112KB) and its stale mention of
  the now-dropped refresh.

Verified: tsc clean, prettier clean, the full targeted suite (142
tests across the 8 affected files) green, and the full `npm test` gate
diffed BY TEST NAME against a clean upstream/master baseline run on
this same machine — identical 201-name failure set both sides (168
tests / 67 files, all pre-existing Windows-environment noise: symlinks,
PTY spawning, POSIX permission bits — none of it touching anything
this PR changes), zero new failures either side of the diff.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R9ZSTEenc8soSu9bTi8Xru

docs/cli-registry.md

@@ -137,9 +137,14 @@ registry exists to prevent.
 
 The install.sh copy is **embedded, not fetched**, and is the FULL catalogue. An earlier design
 fetched it and fell back to a hardcoded two-CLI list, which degraded silently on an empty
-response; there is no degraded mode to fall into now. An optional, opt-in refresh
-(`CODEMAN_CLI_CATALOGUE_URL`, or `CODEMAN_REFRESH_CLI_CATALOGUE=1`) exists for a stale local
-copy, and warns on all three failure shapes — empty body, unparseable content, failed fetch.
+response; there is no degraded mode to fall into now, and no network fetch either — a `curl |
+bash` from master already carries a catalogue exactly as fresh as the script itself, so there is
+nothing a refresh would buy that isn't already true. An earlier draft added an opt-in refresh
+with a `TRUSTED`/`DISPLAY` array split to keep it from ever writing the executed command; it was
+dropped before merge rather than shipped half-verified — the split's only actual write was the
+label, `DISPLAY` never diverged from `TRUSTED` in practice, and the added surface (a second
+array, a fetch path, three failure shapes to warn on) bought nothing the embedded copy didn't
+already have.
 
 ### The install-command trust boundary
 
@@ -147,12 +152,13 @@ Three rules, and the middle one is why the embed matters:
 
 1. **The server never executes an entry's `install.command`.** Unchanged, and still enforced by nothing executing it: the field is display text (`CliDiscovery.install.command`).
 2. **`install.sh` executes only commands embedded in itself.** Those arrive in the same file, over the same TLS fetch, in the same commit as the `curl \| bash` line that fetched the script — identical trust to the hardcoded vendor one-liners it replaces.
-3. **Nothing fetched at install time is ever executed.**
+3. **Nothing fetched at install time is ever executed.** There is no second code path that fetches anything after the script itself has been fetched.
 
 That is mechanical rather than a promise. `CLI_INSTALL_CMD_TRUSTED` is written only from the
-generated block and is the only array the installer runs; `CLI_INSTALL_CMD_DISPLAY` is what the
-refresh may rewrite. `test/install-sh-invariants.test.ts` asserts the split holds, that the
-refresh never assigns into a `*_TRUSTED` array, and that it never `eval`s.
+generated block and is the only array the installer ever runs or displays — there is no second
+array a refresh could rewrite, because there is no refresh. `test/install-sh-invariants.test.ts`
+asserts as much: the embedded commands are exactly the registry's, and nothing in `install.sh`
+`eval`s.
 
 ### bash 3.2
 

docs/docker-cases.md

@@ -34,8 +34,9 @@ must not change what is inside an image tagged `codeman/agent:base`, or two mach
 that tag hold different images and every cache decision downstream is a lie. Each entry's
 `enabled` flag IS honoured, so a CLI that ships disabled is never baked in.
 
-Four CLIs keep hand-written layers, because the registry cannot express what makes them
-special:
+Five CLIs keep hand-written layers, because the registry cannot express what makes them
+special (as a REGISTRY field now — `discovery.install.agentImageLayer` in `stock.ts` — rather
+than an id-keyed table duplicated between the two producers of the image's build args):
 
 | CLI | Why it is not in the shared npm layer |
 | ------------- | ------------------------------------------------------------------------------------- |