fix(installer): harden the bootstrap idiom to fail closed (cli#396)

[shujaatTracebloc]

Fixes#396.

Problem

The one-liner we print (and exec) for the installer was bash <(curl -fsSL https://tracebloc.io/i.sh). Process substitution doesn't propagate curl's exit code — on a network/DNS/HTTP failure, bash reads an empty script from the substituted fd and exits 0. So every copy-paste recovery hint derived from it — doctor's reinstall / "set one up" remedies, the cluster-discovery error, and prepareHostManualHint — could report success while nothing ran, or run a partially-downloaded script.

#394's automated path was already fail-closed (temp file + set -e + curl -o); only the copy-paste manual hints inherited the fail-open behavior.

Fix

New internal/installer package holds the URL and the one bootstrap idiom; every consumer derives from installer.Cmd / installer.Script(...). The printed hint is now byte-identical to the command we just tried, and a URL/idiom change lands everywhere at once.

The new shape — download-to-temp-file + set -e, but one line wrapped in a subshell:

(set -e; tmp="$(mktemp)"; trap 'rm -f "$tmp"' EXIT; curl -fsSL --tlsv1.2 https://tracebloc.io/i.sh -o "$tmp"; bash "$tmp")

Why this over the issue's two options:

requirement	bash <(curl … || echo 'exit 1')	multi-line temp-file	this
fails closed on curl error	✅	✅	✅
no partial-download execution	❌ (mid-stream)	✅	✅
single line (PowerShell pastes bottom-up)	✅	❌	✅
interactive stdin preserved	✅	✅	✅

The ( … ) subshell is load-bearing: it scopes set -e/trap so pasting into an interactive shell can't arm errexit on it (which would close the user's terminal on the curl failure) or leave a stray EXIT trap. Running a downloaded file (not a pipe/substitution) keeps the installer's stdin on the TTY.

Verification

• go build ./..., go test ./..., make lint, make check-style, gofmt — all clean.
• New executable test proves fail-closed (exits non-zero against a dead endpoint, offline via 127.0.0.1:1) and paste-safety (no errexit/trap leak into the caller's shell).
• Copy-catalog goldens regenerated — no diff (the idiom only reaches them via %s placeholders; discover.go is in a non-harvested package).

🤖 Generated with Claude Code

---

Note

Low Risk
User-facing installer strings change shape but behavior is intentionally hardened; scope is CLI messaging/exec wrappers with strong regression tests and no auth or data-path changes.

Overview
Fixes cli#396 by replacing the fail-open bash <(curl …) copy-paste hints with a single shared bootstrap command that downloads to a temp file, uses set -e, and wraps everything in a one-line subshell so curl failures exit non-zero and set -e/trap do not leak into the user’s shell when they paste it.

Adds internal/installer (URL, Cmd, Script) as the only source for the installer URL and shell idiom. doctor, upgrade, prepare-host, and cluster discovery errors now all use installer.Cmd / installer.Script instead of local constants or inline URLs. On Unix, executed commands and manual retry hints are the same string (including prepare-host with optional TB_PREPARE_USER).

New tests lock in single-line paste safety, TLS pinning, forbidden pipe/substitution shapes, and an executable check that failed downloads are non-zero without errexit/trap leaks.

^{Reviewed by Cursor Bugbot for commit 047a4a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[shujaatTracebloc]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 429e9e6. Configure here.}

[saadqbal]

Nice — the win here is real: the printed hints were the fail-open bit (bash <(curl …) exits 0 on a bad download), and folding them into the same subshell set -e idiom that exec runs closes that. One helper, all six call sites derive from it, no private copy left. The executable installer_test (bogus endpoint → non-zero + no errexit/trap leak) is exactly the right proof and would go red against the old shape. go test ./internal/{cli,cluster,installer} and go vet both green locally. One tiny doc nit inline, non-blocking.

[shujaatTracebloc]

Good catch — fixed in 047a4a5. You're right: bash <(curl …) keeps stdin on the TTY (process substitution passes a /dev/fd/N filename), so its only fatal flaw is fail-open. Split the two rationales in the installer.Script doc so the stdin argument is scoped to curl | bash and fail-open is called out as the load-bearing reason to reject bash <(curl …). The two #nosec comments are G204-only (compile-time argv) and don't carry the stdin wording, so nothing to change there.

[shujaatTracebloc]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 047a4a5. Configure here.}