fix(self-update): make script self-update opt-in, not automatic (DEVA11Y-475)

README.md

@@ -209,6 +209,25 @@ Fish
 
 You can then edit the `.git/hooks/pre-commit` file to customise the registered pre-commit hook.
 
+---
+## Updating the launcher script
+The launcher scripts no longer update themselves automatically on every run. To pull the latest launcher on demand, run the `self-update` subcommand — the download is checked against a published SHA-256 checksum (an integrity check against corruption in transit, not an authenticity signature, since the script and its checksum share one origin) and is only applied if it matches.
+
+Zsh
+```zsh
+./browserstack-a11y-scan-spm-zsh.sh self-update
+```
+
+Bash
+```bash
+./browserstack-a11y-scan-spm-bash.sh self-update
+```
+
+Fish
+```bash
+./browserstack-a11y-scan-spm-fish.sh self-update
+```
+
 ---
 ## Support
 For any issues or feedback, reach out to support@browserstack.com

scripts/bash/cli.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 GIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
@@ -78,9 +78,10 @@
       $BINARY_PATH a11y $EXTRA_ARGS
 }
 
-# Self-update tracks the latest launcher on `main` so users always run the
-# newest version. DEVA11Y-475/477/478: we deliberately follow main HEAD rather
-# than a pinned revision (per maintainer intent: always take the latest).
+# Self-update pulls the latest launcher from `main` on demand: it runs only via
+# the explicit `self-update` subcommand (DEVA11Y-475), not automatically on every
+# invocation. DEVA11Y-477/478: when it does run we deliberately follow main HEAD
+# rather than a pinned revision (per maintainer intent: take the latest on demand).
 # Hardening retained from the pinning work: download to a temp dir, verify a
 # SHA-256 sidecar (a download-integrity check, NOT an authenticity signature --
 # script and checksum share one origin), sanity-check the shebang, then
@@ -183,16 +184,19 @@
   bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
 }
 
-# Best-effort auto-update: always fetch the latest launcher from main before
-# running. Network/offline failures are silent (rc 0) and operational errors
-# (rc 1) are non-fatal -- the existing script keeps working. An integrity
-# failure (rc 2: checksum mismatch or non-script payload) leaves the verified
-# on-disk script untouched and is surfaced loudly below, but still does not
-# block the tool (per the always-run-latest, never-block design).
-_self_update_rc=0
-script_self_update || _self_update_rc=$?
-if [[ "$_self_update_rc" -eq 2 ]]; then
-  echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+# Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
+# subcommand, never automatically on every invocation. Running it unconditionally
+# before subcommand parsing meant a single compromise of the fetched source silently
+# replaced the running script on every developer's machine, with no way to opt out;
+# gating it behind an explicit command removes that always-on side-effect. Integrity
+# verification (SHA-256 check + atomic staging) still guards the download itself.
+if [[ $SUBCOMMAND == "self-update" ]]; then
+  _self_update_rc=0
+  script_self_update || _self_update_rc=$?
+  if [[ "$_self_update_rc" -eq 2 ]]; then
+    echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+  fi
+  exit "$_self_update_rc"
 fi
 
 if [[ $SUBCOMMAND == "register-pre-commit-hook" ]]; then

scripts/bash/cli.sh.sha256

@@ -1 +1 @@
-2340d95e6ce35ea8656acb02e0b524eeccca02c12a940d44e8cd0c0032b0efdd  cli.sh
+e233e16b32a0ec18d24acf32e8c415d26c4eeecdc287452117fe51de2f4791dc  cli.sh

scripts/bash/spm.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 [ -f "${PWD}/Package.swift" ]
@@ -83,9 +83,10 @@
           scan $EXTRA_ARGS
 }
 
-# Self-update tracks the latest launcher on `main` so users always run the
-# newest version. DEVA11Y-475/477/478: we deliberately follow main HEAD rather
-# than a pinned revision (per maintainer intent: always take the latest).
+# Self-update pulls the latest launcher from `main` on demand: it runs only via
+# the explicit `self-update` subcommand (DEVA11Y-475), not automatically on every
+# invocation. DEVA11Y-477/478: when it does run we deliberately follow main HEAD
+# rather than a pinned revision (per maintainer intent: take the latest on demand).
 # Hardening retained from the pinning work: download to a temp dir, verify a
 # SHA-256 sidecar (a download-integrity check, NOT an authenticity signature --
 # script and checksum share one origin), sanity-check the shebang, then
@@ -183,16 +184,19 @@
   fi
 }
 
-# Best-effort auto-update: always fetch the latest launcher from main before
-# running. Network/offline failures are silent (rc 0) and operational errors
-# (rc 1) are non-fatal -- the existing script keeps working. An integrity
-# failure (rc 2: checksum mismatch or non-script payload) leaves the verified
-# on-disk script untouched and is surfaced loudly below, but still does not
-# block the tool (per the always-run-latest, never-block design).
-_self_update_rc=0
-script_self_update || _self_update_rc=$?
-if [[ "$_self_update_rc" -eq 2 ]]; then
-  echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+# Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
+# subcommand, never automatically on every invocation. Running it unconditionally
+# before subcommand parsing meant a single compromise of the fetched source silently
+# replaced the running script on every developer's machine, with no way to opt out;
+# gating it behind an explicit command removes that always-on side-effect. Integrity
+# verification (SHA-256 check + atomic staging) still guards the download itself.
+if [[ $SUBCOMMAND == "self-update" ]]; then
+  _self_update_rc=0
+  script_self_update || _self_update_rc=$?
+  if [[ "$_self_update_rc" -eq 2 ]]; then
+    echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+  fi
+  exit "$_self_update_rc"
 fi
 
 if [[ $SUBCOMMAND == "register-pre-commit-hook" ]]; then

scripts/bash/spm.sh.sha256

@@ -1 +1 @@
-2d627fbe06991da445f7fbcd8bc8c4f5c4dd126c04372f74dd0f4ab39222c57e  spm.sh
+751b9ac01088fbf8d1a46b179ebea30d4f7691157233652c6b90c078b188f667  spm.sh

scripts/fish/cli.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 export PATH="$PATH:/opt/homebrew/bin"
@@ -90,9 +90,10 @@
       $BINARY_PATH a11y $EXTRA_ARGS
 }
 
-# Self-update tracks the latest launcher on `main` so users always run the
-# newest version. DEVA11Y-475/477/478: we deliberately follow main HEAD rather
-# than a pinned revision (per maintainer intent: always take the latest).
+# Self-update pulls the latest launcher from `main` on demand: it runs only via
+# the explicit `self-update` subcommand (DEVA11Y-475), not automatically on every
+# invocation. DEVA11Y-477/478: when it does run we deliberately follow main HEAD
+# rather than a pinned revision (per maintainer intent: take the latest on demand).
 # Hardening retained from the pinning work: download to a temp dir, verify a
 # SHA-256 sidecar (a download-integrity check, NOT an authenticity signature --
 # script and checksum share one origin), sanity-check the shebang, then
@@ -195,16 +196,19 @@
   bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
 }
 
-# Best-effort auto-update: always fetch the latest launcher from main before
-# running. Network/offline failures are silent (rc 0) and operational errors
-# (rc 1) are non-fatal -- the existing script keeps working. An integrity
-# failure (rc 2: checksum mismatch or non-script payload) leaves the verified
-# on-disk script untouched and is surfaced loudly below, but still does not
-# block the tool (per the always-run-latest, never-block design).
-_self_update_rc=0
-script_self_update || _self_update_rc=$?
-if [[ "$_self_update_rc" -eq 2 ]]; then
-  echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+# Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
+# subcommand, never automatically on every invocation. Running it unconditionally
+# before subcommand parsing meant a single compromise of the fetched source silently
+# replaced the running script on every developer's machine, with no way to opt out;
+# gating it behind an explicit command removes that always-on side-effect. Integrity
+# verification (SHA-256 check + atomic staging) still guards the download itself.
+if [[ $SUBCOMMAND == "self-update" ]]; then
+  _self_update_rc=0
+  script_self_update || _self_update_rc=$?
+  if [[ "$_self_update_rc" -eq 2 ]]; then
+    echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+  fi
+  exit "$_self_update_rc"
 fi
 
 if [[ $SUBCOMMAND == "register-pre-commit-hook" ]]; then

scripts/fish/cli.sh.sha256

@@ -1 +1 @@
-a2bf0be4a37272548c13a25714e42152de11c31590122880a6ce8c50a55c075b  cli.sh
+332c8583f95291bf72ac4199702697656d28f5b98eba3a6a724a0272ecf77f83  cli.sh

scripts/fish/spm.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 export PATH="$PATH:/opt/homebrew/bin"
@@ -96,9 +96,10 @@
           scan $EXTRA_ARGS
 }
 
-# Self-update tracks the latest launcher on `main` so users always run the
-# newest version. DEVA11Y-475/477/478: we deliberately follow main HEAD rather
-# than a pinned revision (per maintainer intent: always take the latest).
+# Self-update pulls the latest launcher from `main` on demand: it runs only via
+# the explicit `self-update` subcommand (DEVA11Y-475), not automatically on every
+# invocation. DEVA11Y-477/478: when it does run we deliberately follow main HEAD
+# rather than a pinned revision (per maintainer intent: take the latest on demand).
 # Hardening retained from the pinning work: download to a temp dir, verify a
 # SHA-256 sidecar (a download-integrity check, NOT an authenticity signature --
 # script and checksum share one origin), sanity-check the shebang, then
@@ -196,16 +197,19 @@
   fi
 }
 
-# Best-effort auto-update: always fetch the latest launcher from main before
-# running. Network/offline failures are silent (rc 0) and operational errors
-# (rc 1) are non-fatal -- the existing script keeps working. An integrity
-# failure (rc 2: checksum mismatch or non-script payload) leaves the verified
-# on-disk script untouched and is surfaced loudly below, but still does not
-# block the tool (per the always-run-latest, never-block design).
-_self_update_rc=0
-script_self_update || _self_update_rc=$?
-if [[ "$_self_update_rc" -eq 2 ]]; then
-  echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+# Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
+# subcommand, never automatically on every invocation. Running it unconditionally
+# before subcommand parsing meant a single compromise of the fetched source silently
+# replaced the running script on every developer's machine, with no way to opt out;
+# gating it behind an explicit command removes that always-on side-effect. Integrity
+# verification (SHA-256 check + atomic staging) still guards the download itself.
+if [[ $SUBCOMMAND == "self-update" ]]; then
+  _self_update_rc=0
+  script_self_update || _self_update_rc=$?
+  if [[ "$_self_update_rc" -eq 2 ]]; then
+    echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+  fi
+  exit "$_self_update_rc"
 fi
 
 if [[ $SUBCOMMAND == "register-pre-commit-hook" ]]; then

scripts/fish/spm.sh.sha256

@@ -1 +1 @@
-8fe00a7635d3ad66d7197994631c1a58581d4b3a845453f72e5e237338dea24e  spm.sh
+0b54691444c32682e9a14c301ac332d2c13d0874698d009272d35a123e5075fb  spm.sh

scripts/zsh/cli.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 # Shell specific
@@ -89,9 +89,10 @@
       $BINARY_PATH a11y $EXTRA_ARGS
 }
 
-# Self-update tracks the latest launcher on `main` so users always run the
-# newest version. DEVA11Y-475/477/478: we deliberately follow main HEAD rather
-# than a pinned revision (per maintainer intent: always take the latest).
+# Self-update pulls the latest launcher from `main` on demand: it runs only via
+# the explicit `self-update` subcommand (DEVA11Y-475), not automatically on every
+# invocation. DEVA11Y-477/478: when it does run we deliberately follow main HEAD
+# rather than a pinned revision (per maintainer intent: take the latest on demand).
 # Hardening retained from the pinning work: download to a temp dir, verify a
 # SHA-256 sidecar (a download-integrity check, NOT an authenticity signature --
 # script and checksum share one origin), sanity-check the shebang, then
@@ -194,16 +195,19 @@
   bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
 }
 
-# Best-effort auto-update: always fetch the latest launcher from main before
-# running. Network/offline failures are silent (rc 0) and operational errors
-# (rc 1) are non-fatal -- the existing script keeps working. An integrity
-# failure (rc 2: checksum mismatch or non-script payload) leaves the verified
-# on-disk script untouched and is surfaced loudly below, but still does not
-# block the tool (per the always-run-latest, never-block design).
-_self_update_rc=0
-script_self_update || _self_update_rc=$?
-if [[ "$_self_update_rc" -eq 2 ]]; then
-  echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+# Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
+# subcommand, never automatically on every invocation. Running it unconditionally
+# before subcommand parsing meant a single compromise of the fetched source silently
+# replaced the running script on every developer's machine, with no way to opt out;
+# gating it behind an explicit command removes that always-on side-effect. Integrity
+# verification (SHA-256 check + atomic staging) still guards the download itself.
+if [[ $SUBCOMMAND == "self-update" ]]; then
+  _self_update_rc=0
+  script_self_update || _self_update_rc=$?
+  if [[ "$_self_update_rc" -eq 2 ]]; then
+    echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+  fi
+  exit "$_self_update_rc"
 fi
 
 if [[ $SUBCOMMAND == "register-pre-commit-hook" ]]; then

scripts/zsh/cli.sh.sha256

@@ -1 +1 @@
-0a6efbbe2e0578b6e8037bb149145148d2767208636c3899d0b275a319073263  cli.sh
+67edf6abb80741b1f723f07533448288de7652aba859499d287672e8c6c299b4  cli.sh

scripts/zsh/spm.sh

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash -il
 
 # Shell specific
@@ -95,9 +95,10 @@
           scan $EXTRA_ARGS
 }
 
-# Self-update tracks the latest launcher on `main` so users always run the
-# newest version. DEVA11Y-475/477/478: we deliberately follow main HEAD rather
-# than a pinned revision (per maintainer intent: always take the latest).
+# Self-update pulls the latest launcher from `main` on demand: it runs only via
+# the explicit `self-update` subcommand (DEVA11Y-475), not automatically on every
+# invocation. DEVA11Y-477/478: when it does run we deliberately follow main HEAD
+# rather than a pinned revision (per maintainer intent: take the latest on demand).
 # Hardening retained from the pinning work: download to a temp dir, verify a
 # SHA-256 sidecar (a download-integrity check, NOT an authenticity signature --
 # script and checksum share one origin), sanity-check the shebang, then
@@ -195,16 +196,19 @@
   fi
 }
 
-# Best-effort auto-update: always fetch the latest launcher from main before
-# running. Network/offline failures are silent (rc 0) and operational errors
-# (rc 1) are non-fatal -- the existing script keeps working. An integrity
-# failure (rc 2: checksum mismatch or non-script payload) leaves the verified
-# on-disk script untouched and is surfaced loudly below, but still does not
-# block the tool (per the always-run-latest, never-block design).
-_self_update_rc=0
-script_self_update || _self_update_rc=$?
-if [[ "$_self_update_rc" -eq 2 ]]; then
-  echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+# Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
+# subcommand, never automatically on every invocation. Running it unconditionally
+# before subcommand parsing meant a single compromise of the fetched source silently
+# replaced the running script on every developer's machine, with no way to opt out;
+# gating it behind an explicit command removes that always-on side-effect. Integrity
+# verification (SHA-256 check + atomic staging) still guards the download itself.
+if [[ $SUBCOMMAND == "self-update" ]]; then
+  _self_update_rc=0
+  script_self_update || _self_update_rc=$?
+  if [[ "$_self_update_rc" -eq 2 ]]; then
+    echo "Self-update: integrity verification FAILED; kept the existing verified script (possible corruption or tampering)." >&2
+  fi
+  exit "$_self_update_rc"
 fi
 
 if [[ $SUBCOMMAND == "register-pre-commit-hook" ]]; then

scripts/zsh/spm.sh.sha256

@@ -1 +1 @@
-507bb44d5a17a4e15f59fcd3cdc04692a39a65abc2e4bf5375340939ce484a98  spm.sh
+d305feab7c9d5f023087fbde25a4d8bbbff1376a3f10f1b25f73166f4f0ac038  spm.sh