fix(build): harden build.sh (verify gate, derived deps, dev bench) by Chemaclass · Pull Request #835 · TypedDevs/bashunit

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass · 2026-07-19T16:03:44Z

🤔 Background

Related #834

An audit of build.sh found that --verify never propagated a failing suite to CI, a missing embed marker could silently corrupt the artifact, and the hand-maintained deps list had drifted from the entrypoint — shipping benchmark.sh in the binary while ./bashunit bench crashed in dev mode.

💡 Changes

Fail the build when verification fails, when embed markers are missing, or when the artifact fails bash -n; run under set -euo pipefail
Derive the embed list from the entrypoint's source order (single source of truth), guard duplicate embeds, drop eval
Source src/benchmark.sh from the dev entrypoint and add an acceptance regression test for bashunit bench
set -u exposed dead code: Windows checksum skip compared the long-gone $_OS; now uses initialised $_BASHUNIT_OS

https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

- ./build.sh --verify now exits non-zero when the built binary fails the suite; previously CI saw green on a red verification run - build.sh runs under set -euo pipefail; missing embed markers abort instead of silently corrupting the artifact, and every build is gated behind bash -n - the embed list is derived from the entrypoint's source order (single source of truth) instead of a hand-maintained array; src/dev/ stays excluded and duplicate embeds are guarded by a visited list - drop eval when resolving $BASHUNIT_ROOT_DIR in sourced paths; anchor the source-line strip; unique temp file per build - set -u exposed dead code: the Windows checksum skip compared long-gone $_OS; check_os is now initialised and compares $_BASHUNIT_OS - the dev entrypoint never sourced src/benchmark.sh, so ./bashunit bench crashed with 'command not found' from a checkout while the built binary worked; source it and add an acceptance regression test Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

The new --verify gate exposed that verification had been silently crashing since 2025-06: six test files resolved repo resources through $BASHUNIT_ROOT_DIR, which points at the build output folder (no src/, no tools/) when the built binary runs the suite. - benchmark_test: drop the src source entirely; the entrypoint and the built binary both provide the module now - check_os_test / learn_test: resolve src/ relative to the test file - helpers_test / coverage_percent_test: use repo-cwd-relative paths, matching how the same helpers already source globals.sh - globals_test: observe caller_filename through a helper in the test file so the asserted frame no longer depends on the framework layout Verified green via BASHUNIT_BUILD_DIR runs on macOS bash 3.2 and ubuntu:24.04 (docker) — first fully passing verification since the gap opened. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

--stop-on-failure and the report flags (--log-junit, --report-html, --report-tap, --report-json) were exported, so any nested bashunit run — bashunit's own acceptance tests under build.sh --verify, or a user's script under test that calls bashunit — inherited them. Nested runs aborted before rerun::persist wrote .bashunit/last-failed, overwrote the parent's report files, and blew the per-run awk fork budget: the exact three failures the new verify gate surfaced on ubuntu CI. These flags are this-process-only (parallel stop uses a flag file, sync stop uses exit codes, reports are written by the main shell after aggregation), so assign without export; export -n also strips the export attribute a `set -o allexport` .env load may have applied. Verified: official ./build.sh --verify green on macOS bash 3.2 and ubuntu:24.04 (docker, runner-like tooling), plus a leak-probe acceptance regression test that fails on the previous behaviour. Closes#834 Claude-Session: https://claude.ai/code/session_01JSeB8UzLCpqst55hAK6dED

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Chemaclass added the enhancement New feature or request label Jul 19, 2026

Chemaclass self-assigned this Jul 19, 2026

Chemaclass added 2 commits July 19, 2026 18:21

Chemaclass merged commit 559180e into mainJul 19, 2026
37 checks passed

Chemaclass deleted the feat/834-harden-build-sh branch July 19, 2026 16:42

Uh oh!

Uh oh!

Conversation

Chemaclass commented Jul 19, 2026

🤔 Background

💡 Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Chemaclass commented Jul 19, 2026

🤔 Background

💡 Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Chemaclass commented Jul 19, 2026

🤔 Background

💡 Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Chemaclass commented Jul 19, 2026

🤔 Background

💡 Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Chemaclass commented Jul 19, 2026

🤔 Background

💡 Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant