bug: preserve literal PATH entries during deduplication #542

Goal

Deduplicate PATH without performing filename expansion or adding new search directories.

Background and reproduction

Release review of a90aa1429647b6eb4820a01aabe37799ca55ad5e; reproduced on macOS arm64 with Bash 5.3.20.

base_std_dedupe_path loops over unquoted $PATH. After colon splitting, Bash performs pathname expansion. A legal directory name containing *, ?, or brackets is interpreted as a glob and can add unrelated search directories. base_std_add_to_path calls this helper unconditionally and inherits the problem.

Reproduction in a disposable directory root:

mkdir -p "$root/literal*" "$root/literal-one" "$root/literal-two"
source lib/bash/std/lib_std.sh
PATH="$root/literal*:/usr/bin"
base_std_dedupe_path
printf '%s\n' "$PATH"

Expected: $root/literal*:/usr/bin. Actual: $root/literal*:$root/literal-one:$root/literal-two:/usr/bin. The helper changes command-search precedence and includes paths the caller did not provide. Caller nullglob/failglob options can also change handling of unmatched patterns.

The README contract promises removal of duplicates and empty entries; it does not authorize glob expansion. The existing regression covers only ordinary names and empty elements.

Scope and acceptance criteria

• Split PATH into literal elements without pathname expansion; keep the first occurrence and existing documented empty-entry policy.
• Test literal glob characters, spaces and newlines in directory names, duplicates, and matching/unmatched patterns under default, nullglob and failglob modes.
• Exercise the behavior through both base_std_dedupe_path and base_std_add_to_path.
• Preserve caller shell options and IFS, and add the literal-path guarantee to the PATH helper documentation.

Validation

Run the harmless directory reproduction, focused std BATS and shell-option probes on supported Bash versions, then tests/validate.sh.

Non-goals

No release publication, unrelated API redesign, or changes to consumer workspaces.

Project fields

• Status: Ready
• Priority: P2
• Area: Shell
• Initiative: Adoption Polish
• Size: S
• Milestone: v2.2.0

Agent assignment

Assignee: @codeforester. Implement through the normal issue-backed worktree and reviewed PR workflow.