* chore: remove cargo-dist, use native fetch for npm installer
* fix: harden npm scripts — spawnSync, signal handling, binary-exists check
* fix: address PR review comments
- Add null body guard for fetch response
- Fix PowerShell Expand-Archive path quoting vulnerability
- Sanitize error output to prevent ANSI escape injection
- Add proxy support limitation note
- Fix upgrade bug: use .version marker so npm update downloads new binary
- Downgrade changeset from minor to patch (chore, not feature)
- Update AGENTS.md: remove stale cargo-dist reference from labels
* fix: use flat archives for consistent tar/zip extraction
Both tar.gz and zip archives now contain files at root (no nested
directory). Removes --strip-components 1 from install.js since it is
no longer needed. This makes extraction consistent across platforms.
---------
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
- Fix typo: mgail.com → gmail.com in flake.nix maintainer metadata
- Add -u (undefined vars) and -o pipefail to coverage.sh, consistent
with version-sync.sh and tag-release.sh
The idempotency guard only checked local tags, but CI checkouts
don't fetch tags. Add git ls-remote fallback so re-runs of the
Release workflow skip already-pushed tags.
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
Justin Poehnelt