Fix Windows and Linux install paths found by static review

Windows x64 had no working install path at all. Four separate defects, each
sufficient on its own:

  - The Package step wrote zips to <repo>/packages/out. `cd dist/<name>/bin` is
    five levels below the repo root, not four, so upload-artifact found nothing
    and every zip target (both Windows, both macOS) published no asset. Now
    uses an absolute $GITHUB_WORKSPACE/out.

  - build.ts smoke-tested `bin/utmstack`, but Bun appends .exe for
    bun-windows-* targets. Upstream cross-builds from Linux so this branch
    never ran; building Windows natively activates it, and it called
    process.exit(1) and failed the build.

  - The bash installer moved `$tmp/utmstack` — the Windows archive contains
    utmstack.exe, so the mv aborted under set -e, and an installed binary
    without .exe would not execute anyway.

  - It also hard-required unzip, which Git for Windows does not ship. Now
    accepts bsdtar, which reads zip.

Linux fixes:

  - A failed release lookup aborted the installer silently: under
    `set -euo pipefail` the command substitution kills the script, and the
    `$? -ne 0` branch below it was unreachable.

  - Two download calls lacked curl -f, so a 404 wrote GitHub's HTML error page
    to disk, curl exited 0, and tar failed with "not in gzip format" — the
    exact failure an arm64 user hits when an asset is missing.

  - An unset $SHELL aborted under `set -u` after installing the binary but
    before PATH setup and the MCP install.

PowerShell:

  - Fail used `exit`, which closes the user's console under `irm | iex` and
    escapes the caller's try/catch inside a &-invoked scriptblock — so an MCP
    install failure killed the CLI installer despite the surrounding catch.
    Now throws.

  - The CLI installer expanded into the same temp dir holding the archive and
    checksums.txt, then copied both into the install directory.

  - Replacing a running executable throws on Windows; both installers now say
    so instead of dying half-done.

  - PROCESSOR_ARCHITEW6432 fallback, so a 32-bit PowerShell host on x64 is not
    misreported as unsupported. $ProgressPreference silenced: on PS 5.1 the
    progress bar makes large downloads about ten times slower.

The MCP installer now redirects Git Bash users to install.ps1 rather than
refusing outright — that path is how the CLI installer tries to add SIEM tools
on Windows. Dropped a dead x86_64-only libc guard that made the musl check look
conditional on ARM64.

Both PowerShell scripts re-validated on a real Windows ARM64 machine.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Rick Valdes

.github/workflows/utmstack-release.yml

@@ -110,21 +110,23 @@ jobs:
         working-directory: packages/opencode
         run: |
           set -eu
-          mkdir -p ../../out
+          # Absolute output dir. A relative "../.." from inside dist/<name>/bin
+          # is five levels from the repo root and is trivially miscounted.
+          OUT="$GITHUB_WORKSPACE/out"
+          mkdir -p "$OUT"
           for dir in dist/*/; do
             name=$(basename "$dir")
             [ -d "$dir/bin" ] || continue
             asset=$(echo "$name" | sed 's/^opencode-/utmstack-/')
             if [ "${{ matrix.ext }}" = "tar.gz" ]; then
-              # COPYFILE_DISABLE / --no-xattrs keep macOS AppleDouble files and
-              # the com.apple.provenance xattr out of the archive; without them
-              # Linux tar warns on every extracted file.
-              env COPYFILE_DISABLE=1 tar --no-xattrs -czf "../../out/${asset}.tar.gz" -C "$dir/bin" .
+              tar -czf "$OUT/${asset}.tar.gz" -C "$dir/bin" .
             else
-              (cd "$dir/bin" && env COPYFILE_DISABLE=1 7z a -tzip "../../../../out/${asset}.zip" . >/dev/null)
+              # COPYFILE_DISABLE keeps macOS AppleDouble "._*" files out of the
+              # zip; -X drops extended attributes. Both are no-ops on Windows.
+              (cd "$dir/bin" && env COPYFILE_DISABLE=1 7z a -tzip "$OUT/${asset}.zip" . >/dev/null)
             fi
           done
-          ls -lh ../../out/
+          ls -lh "$OUT"
 
       - uses: actions/upload-artifact@v4
         with:

install

@@ -179,17 +179,21 @@ else
              exit 1
         fi
     else
-        if ! command -v unzip >/dev/null 2>&1; then
-            echo -e "${RED}Error: 'unzip' is required but not installed.${NC}"
+        # Git Bash on Windows ships tar (bsdtar, which reads zip) but NOT unzip,
+        # so accept either rather than hard-requiring unzip.
+        if ! command -v unzip >/dev/null 2>&1 && ! command -v tar >/dev/null 2>&1; then
+            echo -e "${RED}Error: either 'unzip' or 'tar' is required but neither is installed.${NC}"
             exit 1
         fi
     fi
 
     if [ -z "$requested_version" ]; then
         url="https://github.com/utmstack/utmstack-cli/releases/latest/download/$filename"
-        specific_version=$(curl -s https://api.github.com/repos/utmstack/utmstack-cli/releases/latest | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
+        # `set -euo pipefail` makes a failed curl abort here silently, and the
+        # $? test below can never see a non-zero status. Capture it explicitly.
+        specific_version=$(curl -fsSL https://api.github.com/repos/utmstack/utmstack-cli/releases/latest 2>/dev/null | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p') || true
 
-        if [[ $? -ne 0 || -z "$specific_version" ]]; then
+        if [ -z "$specific_version" ]; then
             echo -e "${RED}Failed to fetch version information${NC}"
             exit 1
         fi
@@ -292,7 +296,7 @@ download_with_progress() {
     trap "trap - RETURN; rm -f \"$tracefile\"; printf '\033[?25h' >&4; exec 4>&-" RETURN
 
     (
-        curl --trace-ascii "$tracefile" -s -L -o "$output" "$url"
+        curl -f --trace-ascii "$tracefile" -s -L -o "$output" "$url"
     ) &
     local curl_pid=$!
 
@@ -336,17 +340,36 @@ download_and_install() {
 
     if [[ "$os" == "windows" ]] || ! [ -t 2 ] || ! download_with_progress "$url" "$tmp_dir/$filename"; then
         # Fallback to standard curl on Windows, non-TTY environments, or if custom progress fails
-        curl -# -L -o "$tmp_dir/$filename" "$url"
+        curl -f -# -L -o "$tmp_dir/$filename" "$url" || {
+            echo -e "${RED}Download failed: $url${NC}"
+            echo -e "${MUTED}That build may not exist for this platform in this release.${NC}"
+            exit 1
+        }
     fi
 
     if [ "$os" = "linux" ]; then
         tar -xzf "$tmp_dir/$filename" -C "$tmp_dir"
-    else
+    elif command -v unzip >/dev/null 2>&1; then
         unzip -q "$tmp_dir/$filename" -d "$tmp_dir"
+    else
+        # bsdtar (Git Bash, macOS) extracts zip archives too.
+        tar -xf "$tmp_dir/$filename" -C "$tmp_dir"
     fi
 
-    mv "$tmp_dir/utmstack" "$INSTALL_DIR"
-    chmod 755 "${INSTALL_DIR}/utmstack"
+    # Windows archives carry utmstack.exe; every other platform carries a
+    # bare "utmstack". Moving the wrong name aborts under `set -e`, and an
+    # installed Windows binary without .exe would not be executable.
+    binary_name="utmstack"
+    if [ "$os" = "windows" ]; then
+        binary_name="utmstack.exe"
+    fi
+    if [ ! -f "$tmp_dir/$binary_name" ]; then
+        echo -e "${RED}Error: archive did not contain $binary_name${NC}"
+        echo -e "${MUTED}Contents: $(ls "$tmp_dir" | tr '\n' ' ')${NC}"
+        exit 1
+    fi
+    mv "$tmp_dir/$binary_name" "$INSTALL_DIR"
+    chmod 755 "${INSTALL_DIR}/${binary_name}"
     rm -rf "$tmp_dir"
 }
 
@@ -382,7 +405,7 @@ add_to_path() {
 
 XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-$HOME/.config}
 
-current_shell=$(basename "$SHELL")
+current_shell=$(basename "${SHELL:-/bin/sh}")
 case $current_shell in
     fish)
         config_files="$HOME/.config/fish/config.fish"

install.ps1

@@ -7,20 +7,30 @@
 # skipped, the UTMStack MCP server that provides the SIEM tools.
 
 $ErrorActionPreference = 'Stop'
+# On PowerShell 5.1 the Invoke-WebRequest progress bar makes large
+# downloads roughly an order of magnitude slower.
+$ProgressPreference = 'SilentlyContinue'
 
 $Repo    = 'utmstack/utmstack-cli'
 $App     = 'utmstack'
 $Version = if ($env:UTMSTACK_VERSION) { $env:UTMSTACK_VERSION } else { 'latest' }
 
 function Info($m) { Write-Host $m }
-function Fail($m) { Write-Host "error: $m" -ForegroundColor Red; exit 1 }
+# `throw`, not `exit`: these scripts are documented for `irm ... | iex`, which
+# runs in the caller's scope — `exit` would close the user's console before
+# they could read the error, and inside a &-invoked scriptblock it bypasses
+# the surrounding try/catch entirely.
+function Fail($m) { throw "utmstack install: $m" }
 
 # --- platform ------------------------------------------------------------- #
-$arch = switch ($env:PROCESSOR_ARCHITECTURE) {
+# Under WOW64 (a 32-bit PowerShell host) PROCESSOR_ARCHITECTURE reads x86
+# on an x64 machine; PROCESSOR_ARCHITEW6432 carries the real value.
+$rawArch = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
+$arch = switch ($rawArch) {
     'AMD64' { 'x64' }
     'ARM64' { 'arm64' }
     'x86'   { Fail '32-bit Windows is not supported' }
-    default { Fail "unsupported architecture: $env:PROCESSOR_ARCHITECTURE" }
+    default { Fail "unsupported architecture: $rawArch" }
 }
 $target = "windows-$arch"
 $asset  = "$App-$target.zip"
@@ -82,10 +92,21 @@ try {
     New-Item -ItemType Directory -Force -Path $installDir | Out-Null
 
     Info "Installing to $installDir ..."
-    Expand-Archive -Path $pkg -DestinationPath $tmp -Force
-    $exeSource = Get-ChildItem -Path $tmp -Recurse -Filter "$App.exe" | Select-Object -First 1
+    # Extract into a dedicated subdirectory. Expanding into $tmp would mix the
+    # archive and checksums.txt in with the payload, and the sidecar copy below
+    # would then install them too.
+    $extract = Join-Path $tmp 'extract'
+    New-Item -ItemType Directory -Force -Path $extract | Out-Null
+    Expand-Archive -Path $pkg -DestinationPath $extract -Force
+    $exeSource = Get-ChildItem -Path $extract -Recurse -Filter "$App.exe" | Select-Object -First 1
     if (-not $exeSource) { Fail "archive does not contain $App.exe" }
-    Copy-Item -Path $exeSource.FullName -Destination (Join-Path $installDir "$App.exe") -Force
+
+    # Windows refuses to overwrite a running executable; say so plainly.
+    try {
+        Copy-Item -Path $exeSource.FullName -Destination (Join-Path $installDir "$App.exe") -Force -ErrorAction Stop
+    } catch {
+        Fail "could not write $App.exe - it may be running. Close any $App session and re-run."
+    }
 
     # Ship any sidecar files the archive carries alongside the executable.
     Get-ChildItem -Path $exeSource.DirectoryName -File |

packages/opencode/script/build.ts

@@ -206,7 +206,8 @@ for (const item of targets) {
 
   // Smoke test: only run if binary is for current platform
   if (item.os === process.platform && item.arch === process.arch && !item.abi) {
-    const binaryPath = `dist/${name}/bin/utmstack`
+    // Bun appends .exe when compiling for bun-windows-* targets.
+    const binaryPath = `dist/${name}/bin/utmstack${item.os === "win32" ? ".exe" : ""}`
     console.log(`Running smoke test: ${binaryPath} --version`)
     try {
       const versionOutput = await $`${binaryPath} --version`.text()