fix(bar): harden install handoff per review

Pin xattr and pgrep to absolute /usr/bin paths so quarantine clearing
and process detection cannot be hijacked through a caller-controlled
PATH. Gate the launch prompt on stdin being a TTY instead of stdout, so
piping install output through tee no longer silently skips the
handoff. Detect an already-running CCS Bar via pgrep before prompting:
a running instance gets a quit-and-reopen hint instead of a redundant
launch prompt, while --launch still proceeds explicitly.

tests/unit/commands/bar-command.test.ts

@@ -2116,6 +2116,9 @@ describe('bar install: launch flags and prompt (GH-1504)', () => {
       verifyCompat: async () => ({ compatible: true, reason: 'ok' as const }),
       readAppBundleVersion: () => '1.0.0',
       clearQuarantine: async () => true,
+      // isBarRunning injected as false so tests are deterministic regardless of
+      // whether the real CCS Bar process is running on the test machine.
+      isBarRunning: async () => false,
       getCcsDir: () => path.join(tempHome, '.ccs'),
       getAppsDir: () => appsDir,
       ...extra,
@@ -2222,6 +2225,265 @@ describe('bar install: launch flags and prompt (GH-1504)', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Finding 1 — PATH hijack: xattr must use absolute path /usr/bin/xattr
+// (The default impl is internal; tested via injectable clearQuarantine seam.
+//  The production behavior is captured by the contract test below.)
+// ---------------------------------------------------------------------------
+
+describe('bar install: xattr absolute path contract (Finding 1)', () => {
+  const FAKE_DOWNLOAD_URL =
+    'https://github.com/kaitranntt/ccs/releases/download/ccs-bar-latest/CCS-Bar.app.zip';
+
+  function fakeExtract(appsDir: string) {
+    return async (_url: string, dest: string) => {
+      fs.mkdirSync(path.join(dest, 'CCS Bar.app'), { recursive: true });
+    };
+  }
+
+  it('clearQuarantine injectable dep receives the correct app path (contract test)', async () => {
+    const appsDir = path.join(tempHome, 'Applications');
+    const quarantineArgs: string[] = [];
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    await handleBarInstall([], {
+      fetchReleaseAsset: async () => ({ downloadUrl: FAKE_DOWNLOAD_URL }),
+      downloadAndExtract: fakeExtract(appsDir),
+      verifyCompat: async () => ({ compatible: true, reason: 'ok' }),
+      readAppBundleVersion: () => '1.0.0',
+      clearQuarantine: async (appPath: string) => {
+        quarantineArgs.push(appPath);
+        return true;
+      },
+      launchBar: async () => { /* noop */ },
+      promptLaunch: async () => false,
+      isBarRunning: async () => false,
+      getCcsDir: () => path.join(tempHome, '.ccs'),
+      getAppsDir: () => appsDir,
+    });
+
+    // Production invokes clearQuarantine with the full app path — not a bare binary name.
+    expect(quarantineArgs).toHaveLength(1);
+    expect(quarantineArgs[0]).toBe(path.join(appsDir, 'CCS Bar.app'));
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Finding 2 — TTY gate: prompt gated on stdin.isTTY, not stdout.isTTY
+// ---------------------------------------------------------------------------
+
+describe('bar install: stdin-TTY gate for launch prompt (Finding 2)', () => {
+  const FAKE_DOWNLOAD_URL =
+    'https://github.com/kaitranntt/ccs/releases/download/ccs-bar-latest/CCS-Bar.app.zip';
+
+  function fakeExtract(appsDir: string) {
+    return async (_url: string, dest: string) => {
+      fs.mkdirSync(path.join(dest, 'CCS Bar.app'), { recursive: true });
+    };
+  }
+
+  function baseDeps(appsDir: string, extra?: Partial<Record<string, unknown>>) {
+    return {
+      fetchReleaseAsset: async () => ({ downloadUrl: FAKE_DOWNLOAD_URL }),
+      downloadAndExtract: fakeExtract(appsDir),
+      verifyCompat: async () => ({ compatible: true, reason: 'ok' as const }),
+      readAppBundleVersion: () => '1.0.0',
+      clearQuarantine: async () => true,
+      isBarRunning: async () => false,
+      getCcsDir: () => path.join(tempHome, '.ccs'),
+      getAppsDir: () => appsDir,
+      ...extra,
+    };
+  }
+
+  it('stdin-TTY true + stdout non-TTY: promptLaunch is called (prompt shown via seam)', async () => {
+    // This test proves the prompt path is reached even when stdout is not a TTY,
+    // as long as stdin is a TTY. We verify via the injectable promptLaunch dep.
+    const appsDir = path.join(tempHome, 'Applications');
+    let promptCalled = false;
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    await handleBarInstall([], {
+      ...baseDeps(appsDir),
+      launchBar: async () => { /* noop */ },
+      // promptLaunch returning true simulates stdin-TTY + user answered yes.
+      // The production defaultPromptLaunch now checks stdin.isTTY; by injecting
+      // a mock that returns true we confirm this code path (prompt called, launch invoked).
+      promptLaunch: async () => {
+        promptCalled = true;
+        return false; // user said no — we just want to confirm the dep was called
+      },
+    });
+
+    expect(promptCalled).toBe(true);
+  });
+
+  it('non-TTY stdin path: promptLaunch returns false + hint printed', async () => {
+    // Simulate defaultPromptLaunch behavior on non-TTY stdin: returns false.
+    // The handleBarInstall non-TTY fallback must print the launch hint.
+    const appsDir = path.join(tempHome, 'Applications');
+    let launchCalled = false;
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    // Save and override process.stdin.isTTY to simulate non-TTY stdin.
+    // We also inject promptLaunch that mirrors what defaultPromptLaunch does
+    // on non-TTY stdin (returns false) so the fallback branch executes.
+    const origStdinIsTTY = process.stdin.isTTY;
+    try {
+      // Force stdin to look like non-TTY so the fallback check fires.
+      Object.defineProperty(process.stdin, 'isTTY', { value: false, configurable: true });
+
+      await handleBarInstall([], {
+        ...baseDeps(appsDir),
+        launchBar: async () => {
+          launchCalled = true;
+        },
+        promptLaunch: async () => false, // non-TTY stdin: defaultPromptLaunch returns false
+      });
+    } finally {
+      Object.defineProperty(process.stdin, 'isTTY', {
+        value: origStdinIsTTY,
+        configurable: true,
+      });
+    }
+
+    expect(launchCalled).toBe(false);
+    const allOutput = consoleOutput.join('\n');
+    expect(allOutput).toMatch(/Run `ccs bar` to launch/i);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Finding 3 — Already-running detection via isBarRunning dep
+// ---------------------------------------------------------------------------
+
+describe('bar install: already-running detection (Finding 3)', () => {
+  const FAKE_DOWNLOAD_URL =
+    'https://github.com/kaitranntt/ccs/releases/download/ccs-bar-latest/CCS-Bar.app.zip';
+
+  function fakeExtract(appsDir: string) {
+    return async (_url: string, dest: string) => {
+      fs.mkdirSync(path.join(dest, 'CCS Bar.app'), { recursive: true });
+    };
+  }
+
+  function baseDeps(appsDir: string, extra?: Partial<Record<string, unknown>>) {
+    return {
+      fetchReleaseAsset: async () => ({ downloadUrl: FAKE_DOWNLOAD_URL }),
+      downloadAndExtract: fakeExtract(appsDir),
+      verifyCompat: async () => ({ compatible: true, reason: 'ok' as const }),
+      readAppBundleVersion: () => '1.0.0',
+      clearQuarantine: async () => true,
+      getCcsDir: () => path.join(tempHome, '.ccs'),
+      getAppsDir: () => appsDir,
+      ...extra,
+    };
+  }
+
+  it('when running after install: prompt skipped, restart hint printed', async () => {
+    const appsDir = path.join(tempHome, 'Applications');
+    let promptCalled = false;
+    let launchCalled = false;
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    await handleBarInstall([], {
+      ...baseDeps(appsDir),
+      isBarRunning: async () => true,
+      launchBar: async () => {
+        launchCalled = true;
+      },
+      promptLaunch: async () => {
+        promptCalled = true;
+        return true;
+      },
+    });
+
+    // Prompt must NOT be called when bar is running (without --launch)
+    expect(promptCalled).toBe(false);
+    // launchBar must NOT be invoked without --launch
+    expect(launchCalled).toBe(false);
+
+    const allOutput = consoleOutput.join('\n');
+    // Must print the restart hint
+    expect(allOutput).toMatch(/currently running the previous version/i);
+    expect(allOutput).toMatch(/Quit and reopen/i);
+  });
+
+  it('when not running after install: prompt path unchanged', async () => {
+    const appsDir = path.join(tempHome, 'Applications');
+    let promptCalled = false;
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    await handleBarInstall([], {
+      ...baseDeps(appsDir),
+      isBarRunning: async () => false,
+      launchBar: async () => { /* noop */ },
+      promptLaunch: async () => {
+        promptCalled = true;
+        return false;
+      },
+    });
+
+    // When bar is not running, normal prompt flow applies
+    expect(promptCalled).toBe(true);
+    const allOutput = consoleOutput.join('\n');
+    // The restart hint must NOT appear when bar is not running
+    expect(allOutput).not.toMatch(/currently running the previous version/i);
+  });
+
+  it('pgrep error treated as not running: prompt path unchanged', async () => {
+    // Simulate pgrep failure (e.g. not available, permission error) — treated as not running.
+    const appsDir = path.join(tempHome, 'Applications');
+    let promptCalled = false;
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    await handleBarInstall([], {
+      ...baseDeps(appsDir),
+      // Simulate pgrep error — isBarRunning returns false per spec
+      isBarRunning: async () => false,
+      launchBar: async () => { /* noop */ },
+      promptLaunch: async () => {
+        promptCalled = true;
+        return false;
+      },
+    });
+
+    // pgrep error treated as not running → normal prompt flow
+    expect(promptCalled).toBe(true);
+    const allOutput = consoleOutput.join('\n');
+    expect(allOutput).not.toMatch(/currently running the previous version/i);
+  });
+
+  it('--launch with bar already running: launchBar still invoked', async () => {
+    // --launch overrides the already-running guard; opening/activating an already-running
+    // app is harmless.
+    const appsDir = path.join(tempHome, 'Applications');
+    let launchCalled = false;
+
+    const { handleBarInstall } = await loadInstallSubcommand();
+
+    await handleBarInstall(['--launch'], {
+      ...baseDeps(appsDir),
+      isBarRunning: async () => true,
+      launchBar: async () => {
+        launchCalled = true;
+      },
+      promptLaunch: async () => false,
+    });
+
+    expect(launchCalled).toBe(true);
+    // Restart hint must NOT appear when --launch is passed
+    const allOutput = consoleOutput.join('\n');
+    expect(allOutput).not.toMatch(/currently running the previous version/i);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Fix 3 — defaultReadAppBundleVersion: whitespace-only plist value → null
 // ---------------------------------------------------------------------------