fix(install): address CodeRabbit review feedback

- Add curl timeout (--max-time) to prevent hanging on slow networks
- Rename TMPDIR to WORK_DIR to avoid clobbering system env var
- Add chmod +x to ensure binary has execute permissions
- Add error propagation after subroutine calls in batch file
- Remove System32 install attempt in CI mode (use consistent INSTALL_DIR)
- Fix HTTP status regex for HTTP/2 compatibility

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

install.bat

@@ -61,42 +61,23 @@ goto :install_setup
 :install_setup
 echo Installing %BINARY% !VERSION! for Windows...
 call :find_archive "" ARCHIVE
+if errorlevel 1 exit /b 1
 call :download_and_extract
+if errorlevel 1 exit /b 1
 call :install_binary
+if errorlevel 1 exit /b 1
 call :verify_install
+if errorlevel 1 exit /b 1
 goto :done
 
 :install_ci
 echo Installing %BINARY% !VERSION! (CI)...
 call :find_archive "" ARCHIVE
-
+if errorlevel 1 exit /b 1
-REM Download
+call :download_and_extract
-curl -fsSL "https://github.com/%REPO%/releases/download/!VERSION!/!ARCHIVE!" -o "%TEMP%\!ARCHIVE!"
+if errorlevel 1 exit /b 1
-if errorlevel 1 (
+call :install_binary
-    echo ERROR: Failed to download !ARCHIVE!
+if errorlevel 1 exit /b 1
-    exit /b 1
-)
-
-REM Extract - try System32 first (CI often has admin), else local
-powershell -Command "try { Expand-Archive -Force '%TEMP%\!ARCHIVE!' '%TEMP%\core-extract' } catch { exit 1 }"
-if errorlevel 1 (
-    echo ERROR: Failed to extract archive
-    del "%TEMP%\!ARCHIVE!" 2>nul
-    exit /b 1
-)
-
-move /y "%TEMP%\core-extract\%BINARY%.exe" "C:\Windows\System32\%BINARY%.exe" >nul 2>&1
-if errorlevel 1 (
-    if not exist "%INSTALL_DIR%" mkdir "%INSTALL_DIR%"
-    move /y "%TEMP%\core-extract\%BINARY%.exe" "%INSTALL_DIR%\%BINARY%.exe"
-    echo %PATH% | findstr /i /c:"%INSTALL_DIR%" >nul
-    if errorlevel 1 (
-        powershell -Command "[Environment]::SetEnvironmentVariable('Path', [Environment]::GetEnvironmentVariable('Path', 'User') + ';%INSTALL_DIR%', 'User')"
-        set "PATH=%PATH%;%INSTALL_DIR%"
-    )
-)
-rmdir /s /q "%TEMP%\core-extract" 2>nul
-del "%TEMP%\!ARCHIVE!" 2>nul
 
 %BINARY% --version || exit /b 1
 goto :done
@@ -104,9 +85,13 @@ goto :done
 :install_dev
 echo Installing %BINARY% !VERSION! (full) for Windows...
 call :find_archive "" ARCHIVE
+if errorlevel 1 exit /b 1
 call :download_and_extract
+if errorlevel 1 exit /b 1
 call :install_binary
+if errorlevel 1 exit /b 1
 call :verify_install
+if errorlevel 1 exit /b 1
 echo.
 echo Full development variant installed. Available commands:
 echo   core dev     - Multi-repo workflows
@@ -117,9 +102,13 @@ goto :done
 :install_variant
 echo Installing %BINARY% !VERSION! (%VARIANT% variant) for Windows...
 call :find_archive "%VARIANT%" ARCHIVE
+if errorlevel 1 exit /b 1
 call :download_and_extract
+if errorlevel 1 exit /b 1
 call :install_binary
+if errorlevel 1 exit /b 1
 call :verify_install
+if errorlevel 1 exit /b 1
 goto :done
 
 REM === Helper Functions ===
@@ -131,7 +120,7 @@ set "_result=%~2"
 REM Try variant-specific first, then full
 if not "%_variant%"=="" (
     set "_try=%BINARY%-%_variant%-windows-amd64.zip"
-    curl -fsSLI "https://github.com/%REPO%/releases/download/!VERSION!/!_try!" 2>nul | findstr /r "HTTP/.* [23]0[02]" >nul
+    curl -fsSLI "https://github.com/%REPO%/releases/download/!VERSION!/!_try!" 2>nul | findstr /r "HTTP/[12].* [23][0-9][0-9]" >nul
     if not errorlevel 1 (
         set "%_result%=!_try!"
         exit /b 0

install.sh

@@ -62,7 +62,7 @@ detect_platform() {
 resolve_version() {
   if [ "$VERSION" = "latest" ]; then
     info "Fetching latest version..."
-    VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+    VERSION=$(curl -fsSL --max-time 10 "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
     if [ -z "$VERSION" ]; then
       error "Failed to fetch latest version from GitHub API"
     fi
@@ -100,18 +100,18 @@ find_archive() {
 }
 
 download_and_extract() {
-  TMPDIR=$(mktemp -d)
+  WORK_DIR=$(mktemp -d)
-  trap 'rm -rf "$TMPDIR"' EXIT
+  trap 'rm -rf "$WORK_DIR"' EXIT
 
   info "Downloading ${ARCHIVE}..."
-  if ! curl -fsSL "$DOWNLOAD_URL" -o "$TMPDIR/$ARCHIVE"; then
+  if ! curl -fsSL --max-time 120 "$DOWNLOAD_URL" -o "$WORK_DIR/$ARCHIVE"; then
     error "Failed to download ${DOWNLOAD_URL}"
   fi
 
   info "Extracting..."
   case "$ARCHIVE" in
-    *.tar.xz) tar -xJf "$TMPDIR/$ARCHIVE" -C "$TMPDIR" || error "Failed to extract archive" ;;
+    *.tar.xz) tar -xJf "$WORK_DIR/$ARCHIVE" -C "$WORK_DIR" || error "Failed to extract archive" ;;
-    *.tar.gz) tar -xzf "$TMPDIR/$ARCHIVE" -C "$TMPDIR" || error "Failed to extract archive" ;;
+    *.tar.gz) tar -xzf "$WORK_DIR/$ARCHIVE" -C "$WORK_DIR" || error "Failed to extract archive" ;;
     *) error "Unknown archive format: $ARCHIVE" ;;
   esac
 }
@@ -120,10 +120,11 @@ install_binary() {
   local install_dir="${1:-/usr/local/bin}"
 
   info "Installing to ${install_dir}..."
+  chmod +x "$WORK_DIR/${BINARY}"
   if [ -w "$install_dir" ]; then
-    mv "$TMPDIR/${BINARY}" "${install_dir}/${BINARY}"
+    mv "$WORK_DIR/${BINARY}" "${install_dir}/${BINARY}"
   else
-    sudo mv "$TMPDIR/${BINARY}" "${install_dir}/${BINARY}"
+    sudo mv "$WORK_DIR/${BINARY}" "${install_dir}/${BINARY}"
   fi
 }
 
@@ -163,10 +164,11 @@ install_ci() {
   download_and_extract
 
   # CI: prefer /usr/local/bin, no sudo prompts
+  chmod +x "$WORK_DIR/${BINARY}"
   if [ -w /usr/local/bin ]; then
-    mv "$TMPDIR/${BINARY}" /usr/local/bin/
+    mv "$WORK_DIR/${BINARY}" /usr/local/bin/
   else
-    sudo mv "$TMPDIR/${BINARY}" /usr/local/bin/
+    sudo mv "$WORK_DIR/${BINARY}" /usr/local/bin/
   fi
 
   ${BINARY} --version