[slayerjain]

Installers: both installers already stopped touching the caller's folder: keploy/enterprise#3166 (released in v3.8.105, served at keploy.io/ent/install.sh) and keploy/keploy#5025 (merged 2026-11-01, served at keploy.io/install.sh). This PR fixes the commands themselves: their curl -O saved the installer into the working directory before any installer code ran. Nothing else has to merge first.

What was wrong

Five READMEs install Keploy with curl -O https://raw.githubusercontent.com/keploy/keploy/main/keploy.sh && source keploy.sh, which saves ./keploy.sh first.

curl -O saves the installer in the working directory. Run from a repository root, it overwrote the repository's own file of that name before any installer code ran, so no installer fix can prevent it.

What changed

Each command now reads source /dev/stdin <<<"$(curl -fsSL URL || echo 'echo Keploy installer download failed >&2; return 1')", with URL as it was.

• It writes no file. It is still sourced, so the PATH the installer sets stays set in the user's shell, as with source install.sh.
• It reads a here-string because macOS's /bin/bash 3.2 sources <(curl ...) as an empty file, returns 0 and installs nothing.
• If the download fails, curl prints its error, the shell prints Keploy installer download failed, and the command returns 1, so the failure shows at the install line and not as a later "keploy: command not found".
• It is the same command the companion PRs in keploy/keploy (README, the CLI's upgrade banner) and keploy/docs use for https://keploy.io/install.sh.

How it was checked

• The diff is the substitution and nothing else: in each changed line, putting the old command back in place of the new one gives the old line byte for byte (indentation, trailing text and line endings kept), and no curl ... -O ... install.sh|keploy.sh or source install.sh|keploy.sh is left in the repository.
• The exact commands, as written in the READMEs, ran from the root of a temp git repo that tracks install.sh, keploy.sh and keploy-enterprise.sh, with only the URL swapped: a stub installer over file://, or the real URL with .no-such-file appended (a real 404 from keploy.io or raw.githubusercontent.com). Shapes: a terminal (SHELL -c), bash -e FILE, bash --noprofile --norc -eo pipefail FILE, and a script on stdin after set -eo pipefail.
  • Linux amd64 (bash 5.2.37, zsh 5.9; dash and sh run the controls only) and macOS 26.7 (/bin/bash 3.2.57, /bin/zsh 5.9; /bin/sh and /bin/dash the controls only): 32 rows each, 0 failures.
  • Success: status 0, the next line runs, PATH reaches the calling shell, git status stays empty.
  • 404: status 1, curl's error and the message; under -e the step stops at the install line.
  • Controls: today's curl -O ... && source install.sh and curl -O ... keploy.sh && source keploy.sh leave the repo dirty (the tracked file overwritten).
• https://raw.githubusercontent.com/keploy/keploy/main/keploy.sh serves byte for byte the script that https://keploy.io/install.sh redirects to (checked 2026-11-01), so the two URLs install the same way.
• With both fixed installers served (checked 2026-11-01: keploy.io/install.sh serves keploy/keploy main's keploy.sh after fix(installer): leave the caller's directory, and other files in /tmp, alone keploy#5025, keploy.io/ent/install.sh serves v3.8.105's), real installs on macOS 26.7 under /bin/bash 3.2 and zsh 5.9, in a -e script run from the root of a temp git repo that tracks install.sh, keploy.sh and keploy-enterprise.sh, with HOME and TMPDIR fresh (telemetry posts dropped; the binary served from one cached copy of the live download):
  • the sourced command with the raw keploy/keploy/main/keploy.sh URL installed Keploy, the next line found and ran $HOME/.keploy/bin/keploy, and git status stayed empty.
    Control: the old curl --silent -O -L https://keploy.io/install.sh && source install.sh line leaves the repo dirty (its own curl -O overwrites install.sh).

Stated limits

• The command needs bash or zsh, as source install.sh did.
• A transfer cut off partway (curl exit 18) hands the shell the part that arrived, then the message and status 1, as any curl | sh install does; a cut inside a comment, a quoted string or a here-document swallows the message line, and the status is then the partial script's. The old curl -O ... && ran nothing after curl failed. The installer keeps its top-level code in its last lines (from line 516 of 596 on 2026-11-01), so a part that arrived mostly defines functions.

Files touched (one command each)

employee-manager/README.md, spring-boot-postgres-graphql/README.md, spring-boot-product-catalog/README.md, spring-petclinic/README.md, user-manager/README.md.

Same fix elsewhere

The same command is being replaced, one PR per repo, in keploy/keploy, keploy/enterprise, keploy/api-server, keploy/enterprise-ui, keploy/vscode-extension-enterprise, keploy/vscode-extension, keploy/docs, keploy/landing, keploy/homebrew-tap, keploy/orderflow, keploy/bruno, and the READMEs of keploy/samples-go, samples-python, samples-typescript, samples-csharp, samples-java and samples-rust. keploy/website and the JetBrains plugin also show the old command, but they are not live, so they were skipped.