chore(release): 1.4.4

The cleanup `trap 'rm -rf "$TMP"' EXIT` referenced a `local TMP` from
inside cmd_sync(). EXIT traps fire when the shell exits, not when the
function returns — by then the function-local was out of scope, and
set -u exploded the trap body with "TMP: unbound variable", which
masked the script's true exit status with 1.

The install/upgrade work itself completed before the trap ran (so it
looked cosmetic), but the non-zero exit broke automated wrappers and
cron jobs that check $?.

Two changes, both small:

  1. Drop `local` so TMP persists at script scope through the EXIT
     trap.
  2. Use `${TMP:-}` in the trap body so any future regression that
     tightens TMP's scope (or adds a code path where TMP is never
     assigned) doesn't re-introduce the same explosion.

Verified with `bash -c 'set -euo pipefail; foo() { local TMP;
TMP=$(mktemp -d); trap "rm -rf \$TMP" EXIT; }; foo'` → reproduces
the original error; the patched form is silent and exits 0.

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to the VirtFusion Direct Provisioning Module for WHMCS.
 
+## [1.4.4] - 2026-04-25
+
+### Bug Fixes
+- **`install.sh`: "TMP: unbound variable" error at script exit, plus exit code 1 even on successful installs.** The cleanup `trap 'rm -rf "$TMP"' EXIT` referenced a `local TMP` from inside `cmd_sync()`. The EXIT trap doesn't fire until the *shell* exits — by which time the function-scoped local is out of scope — and `set -u` then exploded the trap body, masking the real exit code with `1`. Fix: drop `local` so `TMP` persists at script scope until cleanup runs, and switch the trap body to `${TMP:-}` so any future regression that tightens TMP's scope still survives the trap. Cosmetic in practice (the install/upgrade work itself completed before the trap ran), but the non-zero exit broke automated wrappers and cron-driven invocations that check `$?`.
+
 ## [1.4.3] - 2026-04-25
 
 ### Features

install.sh

@@ -135,9 +135,15 @@ cmd_sync() {
   [ -n "$OWNER" ] || { err "Could not detect parent directory owner via stat"; exit 1; }
   info "Owner (from $WHMCS/modules/servers): $OWNER"
 
-  local TMP
+  # NOTE: TMP is intentionally NOT declared `local`. The EXIT trap fires when
+  # the shell exits, not when this function returns — by then a function-local
+  # would be out of scope and `set -u` would explode the trap body with
+  # "TMP: unbound variable", masking the script's real exit code with 1.
+  # The `${TMP:-}` expansion in the trap is belt-and-suspenders: harmless
+  # if TMP somehow ends up unset, and prevents future regressions if anyone
+  # moves the assignment back into a tighter scope.
   TMP=$(mktemp -d)
-  trap 'rm -rf "$TMP"' EXIT
+  trap 'rm -rf "${TMP:-}"' EXIT
 
   info "Downloading $VERSION..."
   curl -fsSL "https://github.com/$REPO/archive/refs/tags/$VERSION.tar.gz" -o "$TMP/src.tar.gz"