Bug: The script exits prematurely on systems with missing dependencies due to an unhandled error in the auto_install function combined with set -e, preventing it from reporting missing tools.
_{Severity: HIGH}

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: claude-ops/scripts/setup.sh#L4

Potential issue: The script `setup.sh` enables `set -e`, which causes the script to exit
immediately upon any command failure. The `auto_install` function returns an exit code
of 1 if a required tool is missing and cannot be automatically installed (e.g., on a
Linux system without Homebrew). Because the `auto_install` functions are called directly
without any error handling, a missing tool will cause the script to terminate
prematurely. This prevents the script from executing its primary logic, which is to
iterate through all dependencies and report a consolidated list of what is missing to
the user. The script fails silently, defeating its purpose in common environments like
Docker or CI.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

Prevent setup script from exiting on first missing tool

Because the script runs with set -e, these unguarded auto_install ... calls abort execution as soon as one tool is missing (e.g., gh on a fresh machine), since auto_install returns 1 in that case. That means the rest of setup checks never run, additional auto-installs are skipped, and the SessionStart hook can emit no actionable ✗ lines, leaving users without the expected readiness guidance.

Useful? React with 👍 / 👎.

GSD install commands reference wrong org name

High Severity

The GSD auto-install commands use auroracapital/get-shit-done while claude-ops/README.md line 63 references Lifecycle-Innovations-Limited/get-shit-done. This org name migration was applied everywhere else in the PR but missed here, so the new GSD auto-install feature — the main new feature of this PR — will fail to find the marketplace/plugin.

 

^{Reviewed by Cursor Bugbot for commit eaec55c. Configure here.}

Empty array expansion crashes script on macOS bash

High Severity

With set -u (nounset) enabled, "${MISSING[@]}" on an empty array triggers an "unbound variable" error in bash 3.2, which is macOS's default. On the happy path where all tools are present, MISSING stays empty and the script aborts before the registry check runs. This script runs on every session start via the SessionStart hook.

 

^{Reviewed by Cursor Bugbot for commit eaec55c. Configure here.}

Script aborts on first missing tool due to set -e

Medium Severity

auto_install returns 1 when a tool is missing and brew is unavailable (or brew install fails). Since callers like auto_install jq jq are in a simple command position, set -e causes the script to exit on the first failure. The remaining tools are never checked, the MISSING array is never fully populated, and npm installs and registry checks are skipped.

 

^{Reviewed by Cursor Bugbot for commit eaec55c. Configure here.}

The GSD auto-install instructions still point at auroracapital/get-shit-done and gsd@auroracapital-get-shit-done, but elsewhere in the docs GSD is referenced under Lifecycle-Innovations-Limited/get-shit-done. This mismatch will cause the wizard’s install command to fail or install from the wrong marketplace; update the marketplace repo and plugin identifier to the intended org/slug consistently throughout this step.

setup.sh runs brew install automatically and is invoked by the SessionStart hook; this can make networked system changes on every session start without explicit user confirmation. Consider making auto-install opt-in (e.g., only when invoked from /ops:setup, or gated behind an env var/flag) and keep SessionStart to a read-only readiness check.

The npm install calls discard stderr and don’t emit any warning on failure (they just skip adding to INSTALLED). If dependency installation fails (offline, permissions, missing npm), the script will silently proceed and later Telegram/plugin scripts may break with no actionable signal. Consider capturing failures and printing a clear ✗ ops: line (and/or the error output) so SessionStart and users can see what went wrong.

The statement “Everything else is installed automatically” is inaccurate given the current behavior: installs depend on Homebrew being present, and some tools (e.g., wacli, gog) are manual installs. Reword this to reflect the actual flow (wizard-guided installs, auto-install only when supported, and Homebrew/macOS assumptions) to avoid misleading users.

This README now instructs installing ops@lifecycle-innovations-limited-claude-ops, but later sections still refer to configuring ops@ops-marketplace and use hard-coded cache paths like ~/.claude/plugins/cache/ops-marketplace/.... That inconsistency is likely to send users to the wrong plugin settings / paths. Please update those references to match the new marketplace/plugin identifier (or prefer ${CLAUDE_PLUGIN_ROOT} in examples).

GSD is listed under the “Plugin-bundled” integrations section, but it’s described elsewhere (and in the setup wizard) as a separate third-party companion plugin. This heading/placement is misleading; consider moving GSD to a dedicated “Companion/Optional plugins” section (or explicitly note it is not bundled with claude-ops).