fix(installer): Windows one-client guard reads clientId via ConvertFrom-Json (#200)

[LukasWodka]

Summary

The Windows one-client-per-machine guard only recognized an existing install when helm get values happened to render clientId in double quotes (clientId:\s*"([^"]+)"). Helm re-serializes stored values on get, so typical clientIds come back unquoted — the guard silently matched nothing and the installer would re-point the machine to a different Client ID, defeating the protection from #192.

Fix: read the values as JSON (helm get values <release> -n <ns> -o json | ConvertFrom-Json) and take .clientId directly — quoting disappears at that layer, and it matches the adjacent comment that already claimed ConvertFrom-Json. Handles null (release with no user values), a missing clientId key, and unparsable output from one release without aborting the scan of the remaining releases. Mirrors what the bash installer's _extract_yaml_value tolerance achieves (scripts/lib/install-client-helm.sh), but without regex-scraping YAML at all.

Tests: the two existing guard tests now serve real-helm-shaped output (JSON for -o json, unquoted YAML otherwise — so a regression back to YAML-scraping fails them), plus new Pester cases covering unquoted / single-quoted / double-quoted YAML views, a null-values release that must not abort the scan, and values without a clientId key that must not trip the guard.

scripts/install-k8s.ps1 is on the signed-manifest surface — scripts/manifest.sha256 regenerated via scripts/gen-manifest.sh (only the install-k8s.ps1 line changed; --check passes).

Note: open PR #337 also touches scripts/install-k8s.ps1 + scripts/manifest.sha256 (+ the same test file) — whichever merges second gets a trivial manifest conflict; resolve by re-running bash scripts/gen-manifest.sh.

Related

Closes #200 · Refs #192, #199

Type of change

• Feature
• Bug fix
• Tech-debt / refactor
• Docs
• Security / hardening
• Breaking change

Test plan

No pwsh on this machine, so the CI-equivalent suite ran in a mcr.microsoft.com/powershell:lts-7.4 Linux container (same invocation as installer-tests.yaml):

• AST parse of both edited files — OK
• PSScriptAnalyzer at CI's error gate — no errors (warnings unchanged, all pre-existing lines)
• Pester >= 5.5 over scripts/tests/ — 95 passed, 0 failed, 6 skipped (skips are the -Skip:(-not $IsWindows) blocks, same as CI's Linux leg); all 7 one-client-guard tests green
• bash scripts/gen-manifest.sh --check — passes

The real-Windows leg runs in CI (unit-pester, windows-latest).

Deployment notes

None — installer script only; ships with the next release artifact regeneration (manifest already updated).

Checklist

• Tests added / updated and passing locally
• Docs updated if behavior or config changed — N/A (behavior restored to what the comment already claimed)
• No secrets / credentials in the diff
• For security-sensitive paths: appropriate reviewer requested

🤖 Generated with Claude Code

---

Note

Low Risk
Installer-only hardening that restores intended one-client protection; behavior is covered by new and updated Pester tests with no runtime service changes.

Overview
Fixes #200: the Windows installer’s one-client-per-machine check no longer scrapes helm get values YAML with a double-quote regex. It now uses helm get values … -o json and ConvertFrom-Json to read .clientId, so unquoted Helm re-serialization can’t bypass the guard and silently replace an existing client.

The release scan is hardened: skip failed/empty JSON, treat literal null and missing clientId as non-matches, and continue on parse errors so one bad release doesn’t stop the rest.

Pester mocks match real Helm (JSON for -o json, varied YAML otherwise) and add cases for quoting styles, null values, and values without clientId. scripts/manifest.sha256 is updated for the signed install-k8s.ps1 artifact.

^{Reviewed by Cursor Bugbot for commit 64151b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 48 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• backend#1040 — docs(rfc): configurable preprocessing & imputation (RFC 0003) · author: @LukasWodka · reviewer: @saadqbal
• backend#1076 — fix(taxonomy): drop dead instance_segmentation category (#1005) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1077 — feat(global_meta): audit/purge command for legacy per-row GlobalMeta (#1007) · author: @LukasWodka · no reviewer assigned
• backend#1084 — fix(metrics): register semseg metrics — pattern-allow iou_class_N + seed static rows (#641) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1085 — fix(api): CycleView returns the JSONField confusion matrix; legacy fallback logged (#1075) · author: @LukasWodka · reviewer: @saqlainsyed007
• cli#229 — fix(data): deprecation notices on renamed aliases + clear no-client message (#879) · author: @LukasWodka · reviewer: @saadqbal
• cli#230 — fix(data delete): resolve the table name case-insensitively; fail closed (#1027) · author: @LukasWodka · reviewer: @saqlainsyed007
• cli#231 — fix(doctor): surface container restart history, not just crash-loop-now (#1028 item 4) · author: @LukasWodka · no reviewer assigned
• cli#232 — feat(ingest): guide users from dataset to creating a use case · author: @LukasWodka · reviewer: @saadqbal
• cli#233 — fix(data ingest): preflight & message polish — schema-type validation, friendly missing-label, help copy, clearer errors (fix(install): visible wait on held apt lock instead of a silent spinner (#740) #213 test: cross-repo fresh-shell last-mile E2E harness (install -> CLI -> cluster info -> push) #214 Post-install self-verification of CLI usability (#738) #215 fix(client): allow training pods to reach mysql-client (v1.2.1) #76) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)