Windows installer: one-client-per-machine guard misses unquoted/single-quoted clientId

[saadqbal]

Source

Bugbot finding (Medium) on PR #199 (the v1.4.5 promotion), in code introduced by #192 (Installer UX: one-per-machine guard). Deferred from the release and tracked here so it doesn't block v1.4.5.

• File: scripts/install-k8s.ps1 ~L1120–1122
• Origin commit: ddb233a / PR Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version #192

Problem

The one-client-per-machine guard on Windows only recognizes an existing install's clientId when helm get values shows it in double quotes. Helm typically emits unquoted or single-quoted YAML, so an existing install is often invisible to the guard — the installer then proceeds with a different Client ID, defeating the one-client-per-machine protection.

Fix direction

Make the clientId detection tolerant of YAML quoting variants — match clientId: followed by an optional single/double quote around the value (e.g. clientId:\s*['"]?<value>['"]?), rather than requiring double quotes. Consider parsing helm get values -o json instead of regex-scraping the YAML, which sidesteps quoting entirely.

Acceptance

• Guard detects an existing install whether clientId is rendered unquoted, single-quoted, or double-quoted
• Test/manual-verify against real helm get values output on Windows
• No regression to the one-client-per-machine behavior added in Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version #192

Severity

Medium — silent failure of a safety guard; can lead to two clients / a Client-ID mismatch on one machine. Not a release blocker for v1.4.5 (Windows-installer-only, guard-bypass not data-loss).