gitbash 3.0.0 → 3.1.0

package/README.md

@@ -76,7 +76,7 @@ curl -fsSL https://raw.githubusercontent.com/jaggli/gitbash/main/install.sh | sh
 irm https://raw.githubusercontent.com/jaggli/gitbash/main/install.ps1 | iex
 ```
 
-It installs to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add that folder to your PATH if the script says so); delete both to uninstall. Set `GITBASH_VERSION` for a specific version, and `GITBASH_INSTALL_DIR` / `GITBASH_BIN_DIR` for other locations.
+It downloads the package published on npm, checks it against npm's sha512 checksum, and installs it to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add that folder to your PATH if the script says so); delete both to uninstall. Set `GITBASH_VERSION` for a specific version, and `GITBASH_INSTALL_DIR` / `GITBASH_BIN_DIR` for other locations.
 
 ## Options
 
@@ -212,7 +212,7 @@ Open the repository's web page in the browser: via the GitHub CLI (`gh repo view
 reset-repo [-n|--dry-run] [-y|--yes]
 ```
 
-Reset the current branch like a fresh clone: fetch, `git reset --hard <remote>/<branch>` and delete all untracked and ignored files (`git clean -dx`). Lists the unpushed commits, local changes and files it removes and asks first. Aborts an unfinished merge or rebase. Files matching `GITBASH_RESET_KEEP` (e.g. `.env`), `.gitbashrc-user` and nested repositories are kept; stashes and other branches are not touched.
+Reset the current branch like a fresh clone: fetch, `git reset --hard <remote>/<branch>` and delete all untracked and ignored files (`git clean -dx`). Lists the unpushed commits, local changes and files it removes and asks first. Aborts an unfinished merge or rebase. Files matching `GITBASH_RESET_KEEP` (e.g. `.env`), `.gitbashrc-user` and nested repositories are kept; stashes and other branches are not touched. Submodules you initialized are reset to the recorded commit; others are left alone (run `git submodule update --init` to clone them).
 
 ### update
 
@@ -348,11 +348,11 @@ Config files are **read, never executed**. Only `GITBASH_*="value"` lines are us
 
 #### Local Configuration
 
-Run `gitbash --config-local` inside a repository to create a committed `.gitbashrc` with overrides for everyone working on it (e.g. a team branch prefix or different thresholds). For security, a committed `.gitbashrc` cannot set `GITBASH_MERGE_COMMAND`.
+Run `gitbash --config-local` inside a repository to create a committed `.gitbashrc` with overrides for everyone working on it (e.g. a team branch prefix or different thresholds). For security, a committed `.gitbashrc` cannot set `GITBASH_MERGE_COMMAND` or `GITBASH_NO_UPDATE_CHECKS`, and its `GITBASH_PROTECTED_BRANCHES` only adds to the branches your own settings protect.
 
 #### User Configuration
 
-Run `gitbash --config-user` to create `.gitbashrc-user` for personal overrides in one repository. It is excluded from git via `.git/info/exclude`.
+Run `gitbash --config-user` to create `.gitbashrc-user` for personal overrides in one repository. It is excluded from git via `.git/info/exclude`. If a repository commits a `.gitbashrc-user` anyway, gitbash treats it like the committed `.gitbashrc` (it cannot set `GITBASH_MERGE_COMMAND`).
 
 **Configuration priority (highest to lowest):**
 
@@ -362,7 +362,7 @@ Run `gitbash --config-user` to create `.gitbashrc-user` for personal overrides i
 
 #### Updates
 
-`gitbash --update` installs the latest release the same way gitbash was installed: with `npm install -g` (or `pnpm add -g`) for a global package, or by running the release's install script again for the same locations.
+`gitbash --update` installs the latest version on npm the same way gitbash was installed: with `npm install -g` (or `pnpm add -g`) for a global package, or with the install script kept in the installation, for the same locations.
 
 gitbash also checks for new releases on its own, at most once a day, in the background while a command runs, so commands never wait for the network. When a new version is known, the next command at a terminal asks (at most every other day) whether to update now, not now, or skip that version for good. It never asks in scripts or pipes.
 

package/bin/gitbash

@@ -23,6 +23,9 @@ VERSION="$(grep -o '"version": *"[^"]*"' "$SCRIPT_DIR/package.json" | head -1 |
 # Not exported: they would leak into git hooks, editors and merge tools.
 # Commands are sourced into this process; nested runs of gitbash set them again.
 export -n SCRIPT_DIR GITBASH_BIN VERSION
+# Read from the environment (a parent gitbash sets them), but not passed on to
+# git hooks, editors and merge tools either
+export -n GITBASH_ASSUME_YES GITBASH_NESTED GB_COLOR 2>/dev/null
 
 # shellcheck source=../commands/_utils.sh
 source "$COMMANDS_DIR/_utils.sh"
@@ -396,7 +399,8 @@ check_pwsh_integration() {
         # Restricted (the default of Windows PowerShell) and AllSigned block the profile
         case "$policy" in
             Restricted|AllSigned|Undefined)
-                if gb_confirm "PowerShell blocks scripts, including your profile ($policy). Allow local scripts (execution policy RemoteSigned)?" y; then
+                # A security setting: never changed by pressing Enter or by GITBASH_ASSUME_YES
+                if gb_confirm --strict "PowerShell blocks scripts, including your profile ($policy). Allow local scripts (execution policy RemoteSigned)?" n; then
                     if "$exe" -NoProfile -NonInteractive -Command 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned -Force'; then
                         print_success "Local scripts allowed."
                     else
@@ -655,7 +659,7 @@ main() {
             gb_load_config
             gb_update_check "$cmd" "$@"
             # Commands run gitbash again (e.g. pr runs commit): no update prompt in there
-            export GITBASH_NESTED=1
+            GITBASH_NESTED=1
             # shellcheck source=/dev/null
             source "$COMMANDS_DIR/$cmd.sh"
             "$cmd" "$@"

package/commands/_self_update.sh

@@ -128,14 +128,14 @@ _gb_fetch() {
     fi
 }
 
-# Print the version of the latest GitHub release, e.g. 2.1.0
+# Print the latest version on npm, e.g. 2.1.0. npm's "latest" tag only moves
+# when a maintainer approves a staged version (2FA); a GitHub release doesn't need that.
 gb_latest_version() {
-    local json tag
-    json=$(_gb_fetch "https://api.github.com/repos/$GB_REPO/releases/latest" 2>/dev/null) || return 1
-    tag=$(printf '%s\n' "$json" | sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' | head -n 1)
-    tag="${tag#v}"
-    [[ "$tag" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
-    echo "$tag"
+    local json version
+    json=$(_gb_fetch "https://registry.npmjs.org/-/package/gitbash/dist-tags" 2>/dev/null) || return 1
+    version=$(printf '%s\n' "$json" | sed -n 's/.*"latest": *"\([^"]*\)".*/\1/p' | head -n 1)
+    [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1
+    echo "$version"
 }
 
 # Returns 0 if version $1 is newer than the running one
@@ -193,9 +193,12 @@ gb_self_update_to() {
     print_success "Updated gitbash $VERSION → $latest"
 }
 
-# Re-run the install script of the new release for the same locations
+# Install version $1 with the install script that came with this copy, for the
+# same locations. Never one downloaded from a git tag: whoever can create a tag
+# would decide what runs. The script downloads the version from npm and checks
+# its sha512 before installing it.
 _gb_self_update_script() {
-    local latest="$1" bin_dir="" key value tmp
+    local latest="$1" bin_dir="" key value
     if [[ -f "$SCRIPT_DIR/.gitbash-install" ]]; then
         while IFS='=' read -r key value; do
             [[ "$key" == "bin_dir" ]] && bin_dir="$value"
@@ -204,27 +207,24 @@ _gb_self_update_script() {
     bin_dir="${bin_dir:-$HOME/.local/bin}"
 
     local -a vars=(GITBASH_VERSION="$latest" GITBASH_INSTALL_DIR="$SCRIPT_DIR" GITBASH_BIN_DIR="$bin_dir")
-    local hint="curl -fsSL https://raw.githubusercontent.com/$GB_REPO/main/install.sh | sudo ${vars[*]} sh"
-    if [[ ! -w "$(dirname "$SCRIPT_DIR")" ]]; then
-        print_error "No permission to write to $(dirname "$SCRIPT_DIR"). Update with:"
+    local hint="curl -fsSL https://raw.githubusercontent.com/$GB_REPO/main/install.sh | ${vars[*]} sh"
+    if [[ ! -f "$SCRIPT_DIR/install.sh" ]]; then
+        # Installed before gitbash 3.1.0, which started to keep the script
+        print_error "This installation has no install script yet. Update once with:"
         echo "  $hint" >&2
         return 1
     fi
-
-    tmp=$(mktemp 2>/dev/null || mktemp -t gitbash) || return 1
-    if ! _gb_fetch "https://raw.githubusercontent.com/$GB_REPO/v$latest/install.sh" > "$tmp" 2>/dev/null ||
-       [[ ! -s "$tmp" ]]; then
-        rm -f "$tmp"
-        print_error "Could not download the install script of gitbash $latest."
+    if [[ ! -w "$(dirname "$SCRIPT_DIR")" ]]; then
+        print_error "No permission to write to $(dirname "$SCRIPT_DIR"). Update with:"
+        echo "  curl -fsSL https://raw.githubusercontent.com/$GB_REPO/main/install.sh | sudo ${vars[*]} sh" >&2
         return 1
     fi
-    print_info "Running the install script of gitbash $latest"
-    if ! env "${vars[@]}" sh "$tmp"; then
-        rm -f "$tmp"
+
+    print_info "Installing gitbash $latest"
+    if ! env "${vars[@]}" sh "$SCRIPT_DIR/install.sh"; then
         print_error "Update failed."
         return 1
     fi
-    rm -f "$tmp"
 }
 
 # gitbash --update

package/commands/_utils.sh

@@ -43,8 +43,8 @@ _gb_color_ok() {
 }
 
 # NO_COLOR (https://no-color.org): a non-empty value turns off all colors.
-# GB_COLOR is the --color value for git and bat in fzf previews; it is
-# exported because previews run in a separate bash started by fzf.
+# GB_COLOR is the --color value for git and bat in fzf previews; run_fzf
+# passes it to fzf, whose previews run in a separate bash.
 if [[ -n "${NO_COLOR:-}" ]]; then
     GB_COLOR="never"
     # Also for git's own output (added to any GIT_CONFIG_* entries already set)
@@ -55,15 +55,25 @@ if [[ -n "${NO_COLOR:-}" ]]; then
 else
     GB_COLOR="always"
 fi
-export GB_COLOR
+
+# Remove terminal control characters from text read from stdin: C0 controls
+# except tab and newline (ESC, BEL, CR, ...), DEL, and C1 controls in UTF-8.
+# Commit messages, file names, branch names and config lines come from
+# repositories and could otherwise change the clipboard or fake output.
+gb_sanitize() {
+    local c1
+    c1=$(printf '\302[\200-\237]')
+    LC_ALL=C tr -d '\000-\010\013-\037\177' | LC_ALL=C sed "s/$c1//g"
+}
 
 _gb_print() {
-    local fd="$1" color="$2" symbol="$3"
+    local fd="$1" color="$2" symbol="$3" text
     shift 3
+    text=$(printf '%s' "$*" | gb_sanitize)
     if _gb_color_ok "$fd"; then
-        printf '\033[%sm%s\033[0m %s\n' "$color" "$symbol" "$*" >&"$fd"
+        printf '\033[%sm%s\033[0m %s\n' "$color" "$symbol" "$text" >&"$fd"
     else
-        printf '%s %s\n' "$symbol" "$*" >&"$fd"
+        printf '%s %s\n' "$symbol" "$text" >&"$fd"
     fi
 }
 
@@ -111,8 +121,8 @@ prompt_read() {
 }
 
 # Yes/no question. Returns 0 for yes, 1 for no. EOF or Enter picks the default.
-# GITBASH_ASSUME_YES=1 (exported by --yes flags, so commands run from a command
-# inherit it) answers yes, unless --strict is given.
+# GITBASH_ASSUME_YES=1 (set by --yes flags and passed on to commands run from
+# a command) answers yes, unless --strict is given.
 # Usage: gb_confirm [--strict] "Question?" y|n
 gb_confirm() {
     local strict=false
@@ -203,6 +213,7 @@ _gb_config_entries() {
 gb_global_config_file() { echo "$HOME/.gitbashrc"; }
 
 # Load ~/.gitbashrc, then <repo>/.gitbashrc, then <repo>/.gitbashrc-user.
+# A .gitbashrc-user that is tracked by git is treated like .gitbashrc.
 gb_load_config() {
     local repo_root="" file scope key value
     repo_root=$(git rev-parse --show-toplevel 2>/dev/null) || repo_root=""
@@ -210,14 +221,32 @@ gb_load_config() {
         case "$scope" in
             global) file=$(gb_global_config_file) ;;
             local) [[ -n "$repo_root" ]] || continue; file="$repo_root/.gitbashrc" ;;
-            user) [[ -n "$repo_root" ]] || continue; file="$repo_root/.gitbashrc-user" ;;
+            user)
+                [[ -n "$repo_root" ]] || continue
+                file="$repo_root/.gitbashrc-user"
+                # A committed .gitbashrc-user came with the repository: as untrusted as .gitbashrc
+                if git -C "$repo_root" ls-files --error-unmatch -- .gitbashrc-user >/dev/null 2>&1; then
+                    scope="local"
+                fi
+                ;;
         esac
+        # A repository's config file must be a file in the repository, not a link to
+        # something else on this machine (whose lines would be printed as warnings)
+        if [[ "$scope" == "local" && -L "$file" ]]; then
+            print_warning "$file: ignored (a symbolic link)"
+            continue
+        fi
         while IFS='=' read -r key value; do
             [[ -z "$key" ]] && continue
-            if [[ "$key" == "GITBASH_MERGE_COMMAND" && "$scope" == "local" ]]; then
-                print_warning "$file: ignored GITBASH_MERGE_COMMAND (a repository cannot choose which program runs; set it in ~/.gitbashrc or .gitbashrc-user)"
+            # A repository cannot choose which program runs, or turn off update checks
+            if [[ "$scope" == "local" && ( "$key" == "GITBASH_MERGE_COMMAND" || "$key" == "GITBASH_NO_UPDATE_CHECKS" ) ]]; then
+                print_warning "$file: ignored $key (a repository cannot set it; set it in ~/.gitbashrc or an uncommitted .gitbashrc-user)"
                 continue
             fi
+            # A repository can protect more branches, but not unprotect yours
+            if [[ "$scope" == "local" && "$key" == "GITBASH_PROTECTED_BRANCHES" ]]; then
+                value="${GITBASH_PROTECTED_BRANCHES:-main master develop release/*} $value"
+            fi
             printf -v "$key" '%s' "$value"
         done < <(_gb_config_entries "$file" warn)
     done
@@ -335,7 +364,9 @@ require_fzf() {
 run_fzf() {
     local bash_path
     bash_path=$(command -v bash)
-    FZF_DEFAULT_OPTS="" FZF_DEFAULT_OPTS_FILE="" SHELL="$bash_path" fzf "$@"
+    # GITBASH_NESTED: bindings that run gitbash (e.g. switch's Del) are nested runs
+    FZF_DEFAULT_OPTS="" FZF_DEFAULT_OPTS_FILE="" SHELL="$bash_path" GB_COLOR="$GB_COLOR" \
+        GITBASH_NESTED=1 GITBASH_ASSUME_YES="${GITBASH_ASSUME_YES:-}" fzf "$@"
 }
 
 # =============================================================================
@@ -346,9 +377,12 @@ gb_remote() {
     echo "${GITBASH_REMOTE:-origin}"
 }
 
-# Current branch name; fails on detached HEAD
+# Current branch name; fails on detached HEAD. Not --short: with a tag of the
+# same name, that prints "heads/<branch>".
 gb_current_branch() {
-    git symbolic-ref --quiet --short HEAD 2>/dev/null
+    local ref
+    ref=$(git symbolic-ref --quiet HEAD 2>/dev/null) || return 1
+    echo "${ref#refs/heads/}"
 }
 
 # Returns 0 if $1 is a valid branch name that can't be mistaken for an option.
@@ -367,9 +401,11 @@ gb_base_branch() {
         echo "$GITBASH_BASE_BRANCH"
         return 0
     fi
-    if branch=$(git symbolic-ref --quiet --short "refs/remotes/$remote/HEAD" 2>/dev/null) &&
-       _gb_valid_branch_name "${branch#"$remote"/}"; then
-        echo "${branch#"$remote"/}"
+    # Full ref name: --short would give "remotes/origin/main" when a tag "origin/main" exists
+    if branch=$(git symbolic-ref --quiet "refs/remotes/$remote/HEAD" 2>/dev/null) &&
+       [[ "$branch" == "refs/remotes/$remote/"* ]] &&
+       _gb_valid_branch_name "${branch#"refs/remotes/$remote/"}"; then
+        echo "${branch#"refs/remotes/$remote/"}"
         return 0
     fi
     for branch in main master; do
@@ -382,17 +418,25 @@ gb_base_branch() {
     return 1
 }
 
-# The ref to compare against: <remote>/<base> if it exists, else the local base
+# The ref to compare against, as a full ref name: refs/remotes/<remote>/<base>
+# if it exists, else refs/heads/<base>. Never a short name like origin/main:
+# git resolves those to a tag of the same name first, and tags come from the remote.
 gb_base_ref() {
     local base="$1" remote
     remote=$(gb_remote)
     if git show-ref --verify --quiet "refs/remotes/$remote/$base"; then
-        echo "$remote/$base"
+        echo "refs/remotes/$remote/$base"
     else
-        echo "$base"
+        echo "refs/heads/$base"
     fi
 }
 
+# Short name of a full ref, for messages: refs/remotes/origin/main -> origin/main
+gb_ref_short() {
+    local ref="${1#refs/remotes/}"
+    echo "${ref#refs/heads/}"
+}
+
 # Fetch the current branch's upstream and, if it has new commits, offer to
 # fast-forward. Returns 1 only when the fast-forward fails.
 gb_offer_fast_forward() {
@@ -431,9 +475,11 @@ gb_is_protected() {
     return 1
 }
 
-# Run another gitbash command (same installation)
+# Run another gitbash command (same installation). GITBASH_NESTED and
+# GITBASH_ASSUME_YES (set by -y) are passed only to it, not exported to git
+# hooks, editors or merge tools.
 gb_run() {
-    "${GITBASH_BIN:-gitbash}" "$@"
+    GITBASH_NESTED=1 GITBASH_ASSUME_YES="${GITBASH_ASSUME_YES:-}" "${GITBASH_BIN:-gitbash}" "$@"
 }
 
 # Fetch the current branch, sync with its remote counterpart and push.
@@ -691,6 +737,12 @@ gb_web_url() {
     echo "$scheme://$host/$path"
 }
 
+# A remote URL for messages, without user name and password or token
+# (https://user:token@host/path -> https://host/path)
+gb_redact_url() {
+    printf '%s' "$1" | sed -E 's#^([A-Za-z][A-Za-z0-9+.-]*://)[^/@]*@#\1#'
+}
+
 # Open a URL in the browser, or print it if no opener is available
 gb_open_url() {
     local url="$1"

package/commands/cleanstash.sh

@@ -44,7 +44,7 @@ EOF
     while [[ $# -gt 0 ]]; do
         case "$1" in
             -h|--help) cleanstash --help; return 0 ;;
-            -y|--yes) export GITBASH_ASSUME_YES=1 ;;
+            -y|--yes) GITBASH_ASSUME_YES=1 ;;
             *)
                 print_error "Unknown argument: $1"
                 echo "Usage: cleanstash [-y|--yes]" >&2

package/commands/cleanup.sh

@@ -106,7 +106,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        export GITBASH_ASSUME_YES=1
+        GITBASH_ASSUME_YES=1
         shift
         ;;
       *)
@@ -183,7 +183,7 @@ EOF
     fi
     entries+=("$preselect|$label|$ts|$branch|$rel|$email|$unpushed|$name")
   done < <(git for-each-ref \
-      --format="%(refname:short)%1f%(committerdate:unix)%1f%(committerdate:relative)%1f%(authoremail)%1f%(upstream:short)%1f%(upstream:track)%1f%(authorname)" \
+      --format="%(refname:lstrip=2)%1f%(committerdate:unix)%1f%(committerdate:relative)%1f%(authoremail)%1f%(upstream:short)%1f%(upstream:track)%1f%(authorname)" \
       refs/heads 2>/dev/null)
 
   # Pre-selected first, then newest first
@@ -235,7 +235,7 @@ EOF
     fi
     if [[ "$dry_run" == true ]]; then
       echo "Would delete ${#selected[@]} branch(es):"
-      printf '  - %s\n' "${selected[@]}"
+      printf '  - %s\n' "${selected[@]}" | gb_sanitize
       return 0
     fi
   else
@@ -322,7 +322,7 @@ ${#sorted[@]} branches, $preselect_count pre-selected" \
     label_of=""
     [[ "$branch" == "$current_branch" ]] && { need_switch=true; label_of=" (current branch)"; }
     [[ "$merged_list" == *" $branch "* ]] || only_merged=false
-    echo "  - $branch$label_of"
+    echo "  - $branch$label_of" | gb_sanitize
   done
   if [[ "$need_switch" == true ]]; then
     echo "Will switch to '$base_branch' first."
@@ -363,8 +363,8 @@ ${#sorted[@]} branches, $preselect_count pre-selected" \
     echo
     print_warning "These branches have commits that are not merged. Deleting them loses those commits:"
     for branch in "${refused[@]}"; do
-      echo "  $branch:"
-      git log --oneline -n 5 "refs/heads/$branch" --not "$base_ref" --remotes 2>/dev/null | sed 's/^/      /'
+      echo "  $branch:" | gb_sanitize
+      git log --oneline -n 5 "refs/heads/$branch" --not "$base_ref" --remotes 2>/dev/null | gb_sanitize | sed 's/^/      /'
     done
     if gb_confirm --strict "Force-delete these ${#refused[@]} branch(es)?" n; then
       for branch in "${refused[@]}"; do

package/commands/commit.sh

@@ -83,7 +83,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        export GITBASH_ASSUME_YES=1
+        GITBASH_ASSUME_YES=1
         shift
         ;;
       --force-with-lease)

package/commands/commits.sh

@@ -60,7 +60,7 @@ EOF
     while [[ $# -gt 0 ]]; do
         case "$1" in
             -a|--all) all=true ;;
-            -y|--yes) export GITBASH_ASSUME_YES=1 ;;
+            -y|--yes) GITBASH_ASSUME_YES=1 ;;
             -*) print_error "Unknown option '$1'. See 'commits --help'."; return 1 ;;
             *)
                 if [[ -n "$count" ]]; then
@@ -98,12 +98,14 @@ EOF
         elif git rev-parse --verify --quiet "$base_ref^{commit}" >/dev/null; then
             log_args=(--not "$base_ref")
             # Also exclude the local base branch when it is ahead of the remote one
-            if [[ "$base_ref" != "$base_branch" ]] &&
+            if [[ "$base_ref" != "refs/heads/$base_branch" ]] &&
                git show-ref --verify --quiet "refs/heads/$base_branch"; then
-                log_args+=("$base_branch")
+                log_args+=("refs/heads/$base_branch")
             fi
-            scope="commits not in '$base_ref' (up to $count)"
-            empty_hint="No commits on '$current_branch' that are not in '$base_ref'. Use 'commits --all' to show all recent commits."
+            local base_name
+            base_name=$(gb_ref_short "$base_ref")
+            scope="commits not in '$base_name' (up to $count)"
+            empty_hint="No commits on '$current_branch' that are not in '$base_name'. Use 'commits --all' to show all recent commits."
         fi
     fi
 
@@ -184,7 +186,7 @@ Showing $scope" \
     echo
     echo "Commits to revert (newest first):"
     for hash in "${to_revert[@]}"; do
-        echo "  - $(git log -1 --format='%h %s' "$hash")"
+        echo "  - $(git log -1 --format='%h %s' "$hash" | gb_sanitize)"
     done
     echo
 

package/commands/create.sh

@@ -103,7 +103,7 @@ EOF
       --hotfix) branch_type="hotfix/"; shift ;;
       --release) branch_type="release/"; shift ;;
       -p|--push) auto_push="yes"; shift ;;
-      -y|--yes) export GITBASH_ASSUME_YES=1; shift ;;
+      -y|--yes) GITBASH_ASSUME_YES=1; shift ;;
       --no-push) auto_push="no"; shift ;;
       --)
         shift
@@ -244,10 +244,10 @@ release/ - Release preparation branches"
   if base_branch=$(gb_base_branch); then
     print_info "Fetching latest '$base_branch' from '$remote'..."
     if git fetch --quiet "$remote" "+refs/heads/$base_branch:refs/remotes/$remote/$base_branch" 2>/dev/null; then
-      start_point="$remote/$base_branch"
+      start_point="refs/remotes/$remote/$base_branch"
     elif git show-ref --verify --quiet "refs/heads/$base_branch"; then
       print_warning "Could not fetch '$base_branch'. Creating the branch from local '$base_branch'."
-      start_point="$base_branch"
+      start_point="refs/heads/$base_branch"
     fi
   fi
   if [[ -z "$start_point" ]]; then
@@ -257,7 +257,7 @@ release/ - Release preparation branches"
   print_info "Creating branch..."
   if [[ -n "$start_point" ]]; then
     git switch --quiet --no-track -c "$branch_name" "$start_point" || { print_error "Failed to create branch."; return 1; }
-    print_success "Created and switched to '$branch_name' (from $start_point)"
+    print_success "Created and switched to '$branch_name' (from $(gb_ref_short "$start_point"))"
   else
     git switch --quiet -c "$branch_name" || { print_error "Failed to create branch."; return 1; }
     print_success "Created and switched to '$branch_name'"

package/commands/pr.sh

@@ -78,7 +78,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        export GITBASH_ASSUME_YES=1
+        GITBASH_ASSUME_YES=1
         shift
         ;;
       *)
@@ -102,7 +102,7 @@ EOF
     return 1
   fi
   if ! base=$(gb_web_url "$remote_url"); then
-    print_error "Don't know how to open '$remote_url' in a browser."
+    print_error "Don't know how to open '$(gb_redact_url "$remote_url")' in a browser."
     return 1
   fi
 

package/commands/repo.sh

@@ -61,7 +61,7 @@ EOF_HELP
     return 1
   fi
   if ! url=$(gb_web_url "$remote_url"); then
-    print_error "Don't know how to open '$remote_url' in a browser."
+    print_error "Don't know how to open '$(gb_redact_url "$remote_url")' in a browser."
     return 1
   fi
 

package/commands/reset-repo.sh

@@ -68,7 +68,7 @@ EOF_HELP
         shift
         ;;
       -y|--yes)
-        export GITBASH_ASSUME_YES=1
+        GITBASH_ASSUME_YES=1
         shift
         ;;
       *)
@@ -100,7 +100,7 @@ EOF_HELP
     return 1
   fi
 
-  local remote target
+  local remote target target_ref
   remote=$(gb_remote)
   if ! git remote get-url "$remote" >/dev/null 2>&1; then
     print_error "No remote '$remote' configured."
@@ -111,10 +111,13 @@ EOF_HELP
     print_error "Failed to fetch '$remote'."
     return 1
   fi
+  # Full ref names for git (a tag called <remote>/<branch> must not win), short ones for messages
   if git show-ref --verify --quiet "refs/remotes/$remote/$branch"; then
     target="$remote/$branch"
+    target_ref="refs/remotes/$remote/$branch"
   else
     target="$branch"
+    target_ref="refs/heads/$branch"
     print_warning "'$branch' is not on '$remote': keeping its commits, only local changes are discarded."
   fi
 
@@ -130,14 +133,14 @@ EOF_HELP
 
   # What would be lost
   local lost_commits changes untracked
-  lost_commits=$(git log --oneline "$target..refs/heads/$branch")
+  lost_commits=$(git log --oneline "$target_ref..refs/heads/$branch")
   changes=$(git status --porcelain --untracked-files=no)
   untracked=$(git clean -n "${clean_args[@]}")
 
   local head_commit
   head_commit=$(git rev-parse "refs/heads/$branch")
   if [[ -z "$lost_commits" && -z "$changes" && -z "$untracked" &&
-        "$(git rev-parse HEAD)" == "$(git rev-parse "$target")" ]]; then
+        "$(git rev-parse HEAD)" == "$(git rev-parse "$target_ref")" ]]; then
     _reset_repo_abort_operations
     print_success "'$branch' is already like a fresh clone of '$target'."
     return 0
@@ -147,17 +150,17 @@ EOF_HELP
   if [[ -n "$lost_commits" ]]; then
     echo
     print_warning "$(printf '%s\n' "$lost_commits" | wc -l | tr -d ' ') unpushed commit(s) will be removed from '$branch':"
-    printf '%s\n' "$lost_commits" | sed 's/^/    /'
+    printf '%s\n' "$lost_commits" | gb_sanitize | sed 's/^/    /'
   fi
   if [[ -n "$changes" ]]; then
     echo
     echo "Local changes to discard:"
-    printf '%s\n' "$changes" | sed 's/^/    /'
+    printf '%s\n' "$changes" | gb_sanitize | sed 's/^/    /'
   fi
   if [[ -n "$untracked" ]]; then
     echo
     echo "Untracked and ignored files to delete:"
-    printf '%s\n' "$untracked" | sed 's/^Would remove /    /'
+    printf '%s\n' "$untracked" | gb_sanitize | sed 's/^Would remove /    /'
   fi
   if [[ ${#keep[@]} -gt 1 ]]; then
     echo
@@ -180,7 +183,7 @@ EOF_HELP
     print_error "Failed to check out '$branch'."
     return 1
   fi
-  if ! git reset --quiet --hard "$target"; then
+  if ! git reset --quiet --hard "$target_ref"; then
     print_error "Failed to reset '$branch' to '$target'."
     return 1
   fi
@@ -189,7 +192,9 @@ EOF_HELP
     return 1
   fi
   if [[ -f .gitmodules ]]; then
-    git submodule update --init --recursive --force --quiet ||
+    # Only submodules that were initialized: --init would clone every URL in
+    # the repository's .gitmodules, which a fresh clone doesn't do either
+    git submodule update --recursive --force --quiet ||
       print_warning "Failed to update submodules."
   fi
 

package/commands/stale.sh

@@ -172,7 +172,7 @@ EOF
             stale_list+="$row"
         fi
     done < <(git for-each-ref --sort=committerdate \
-        --format="%(refname:short)%1f%(committerdate:unix)%1f%(committerdate:relative)%1f%(authoremail)%1f%(authorname)" \
+        --format="%(refname:lstrip=2)%1f%(committerdate:unix)%1f%(committerdate:relative)%1f%(authoremail)%1f%(authorname)" \
         "refs/remotes/$remote" 2>/dev/null)
 
     if [[ "$json_mode" == true ]]; then
@@ -268,7 +268,7 @@ TOGGLE_EOF
 
     echo
     echo "Selected branches to delete from '$remote':"
-    printf '  - %s\n' "${branches_to_delete[@]}"
+    printf '  - %s\n' "${branches_to_delete[@]}" | gb_sanitize
     echo
 
     if ! gb_confirm --strict "Delete these ${#branches_to_delete[@]} branch(es) from '$remote'? This cannot be undone from here." n; then

package/commands/status.sh

@@ -177,7 +177,7 @@ EOF
           print_warning "$path has a merge conflict - resolve it in your editor, then stage it."
           ;;
         ?" ")
-          echo "Unstaging: $path"
+          echo "Unstaging: $path" | gb_sanitize
           if [[ -n "$orig" ]]; then
             _status_unstage "$path" "$orig" || print_error "Failed to unstage $path"
           else
@@ -185,7 +185,7 @@ EOF
           fi
           ;;
         *)
-          echo "Staging: $path"
+          echo "Staging: $path" | gb_sanitize
           git add -A -- "$path" || print_error "Failed to stage $path"
           ;;
       esac
@@ -210,7 +210,7 @@ _status_discard() {
 
   if [[ ${#untracked[@]} -gt 0 ]]; then
     echo "Untracked files/directories to delete:"
-    printf '  - %s\n' "${untracked[@]}"
+    printf '  - %s\n' "${untracked[@]}" | gb_sanitize
     if gb_confirm --strict "Delete these ${#untracked[@]} item(s)? This cannot be undone." n; then
       for path in "${untracked[@]}"; do
         if rm -rf -- "$path"; then
@@ -224,7 +224,7 @@ _status_discard() {
 
   if [[ ${#added[@]} -gt 0 ]]; then
     echo "Newly added files to unstage:"
-    printf '  - %s\n' "${added[@]}"
+    printf '  - %s\n' "${added[@]}" | gb_sanitize
     if gb_confirm --strict "Unstage these ${#added[@]} file(s)?" n; then
       local delete_too=false
       gb_confirm --strict "Also delete them from disk?" n && delete_too=true
@@ -248,7 +248,7 @@ _status_discard() {
       return 0
     fi
     echo "Files to restore to the last commit:"
-    printf '  - %s\n' "${tracked[@]}"
+    printf '  - %s\n' "${tracked[@]}" | gb_sanitize
     if gb_confirm --strict "Discard all changes in these ${#tracked[@]} file(s)? This cannot be undone." n; then
       for path in "${tracked[@]}"; do
         if git restore --source=HEAD --staged --worktree -- "$path" 2>/dev/null ||

package/commands/switch.sh

@@ -11,10 +11,10 @@ _switch_list_branches() {
   current=$(gb_current_branch) || current=""
   if base=$(gb_base_branch 2>/dev/null); then
     base_ref=$(gb_base_ref "$base")
-    merged=$(git for-each-ref --merged "$base_ref" --format='%(refname:short)' refs/heads 2>/dev/null)
+    merged=$(git for-each-ref --merged "$base_ref" --format='%(refname:lstrip=2)' refs/heads 2>/dev/null)
   fi
 
-  local_names=$(git for-each-ref --format='%(refname:short)' refs/heads)
+  local_names=$(git for-each-ref --format='%(refname:lstrip=2)' refs/heads)
   while IFS= read -r name; do
     [[ -z "$name" ]] && continue
     if [[ "$name" != "$current" && "$name" != "$base" ]] && printf '%s\n' "$merged" | grep -qxF -- "$name"; then
@@ -36,7 +36,7 @@ _switch_list_branches() {
       printed_spacer=true
     fi
     printf 'remote: %s\tremote\t%s\n' "$name" "$name"
-  done < <(git for-each-ref --format='%(refname:short)' refs/remotes)
+  done < <(git for-each-ref --format='%(refname:lstrip=2)' refs/remotes)
 }
 
 # Delete the local branch of a list line (called from fzf via 'switch --delete-branch')
@@ -70,9 +70,11 @@ _switch_delete_branch() {
     return 0
   fi
 
-  count=$(git rev-list --count "refs/heads/$name" --not --remotes "$(gb_base_ref "$(gb_base_branch 2>/dev/null || echo HEAD)")" 2>/dev/null || echo "?")
+  local base_ref=HEAD base
+  base=$(gb_base_branch 2>/dev/null) && base_ref=$(gb_base_ref "$base")
+  count=$(git rev-list --count "refs/heads/$name" --not --remotes "$base_ref" 2>/dev/null || echo "?")
   print_warning "'$name' has $count commit(s) that are not merged or pushed:"
-  git log --oneline -n 10 "refs/heads/$name" --not --remotes 2>/dev/null | sed 's/^/    /'
+  git log --oneline -n 10 "refs/heads/$name" --not --remotes 2>/dev/null | gb_sanitize | sed 's/^/    /'
   if gb_confirm --strict "Force-delete '$name' and lose these commits?" n; then
     if git branch -D "$name" >/dev/null 2>&1; then
       print_success "Force-deleted $name"
@@ -246,7 +248,7 @@ EOF
       git switch "$local_branch" || { print_error "Failed to switch branch."; return 1; }
     else
       echo "Creating local branch '$local_branch' tracking '$branch_name'"
-      git switch -c "$local_branch" --track "$branch_name" || { print_error "Failed to switch branch."; return 1; }
+      git switch -c "$local_branch" --track "refs/remotes/$branch_name" || { print_error "Failed to switch branch."; return 1; }
     fi
   fi
   print_success "Switched to branch: $(gb_current_branch)"

package/commands/unstash.sh

@@ -53,7 +53,7 @@ EOF
     while [[ $# -gt 0 ]]; do
         case "$1" in
             -h|--help) unstash --help; return 0 ;;
-            -y|--yes) export GITBASH_ASSUME_YES=1 ;;
+            -y|--yes) GITBASH_ASSUME_YES=1 ;;
             *)
                 print_error "Unknown argument: $1"
                 echo "Usage: unstash [-y|--yes]" >&2

package/commands/update.sh

@@ -57,7 +57,7 @@ EOF
         shift
         ;;
       -y|--yes)
-        export GITBASH_ASSUME_YES=1
+        GITBASH_ASSUME_YES=1
         shift
         ;;
       *)
@@ -86,7 +86,7 @@ EOF
   # -----------------------------
   if [[ "$current_branch" == "$base_branch" ]]; then
     print_info "Pulling latest '$base_branch' from '$remote'..."
-    if git pull --ff-only "$remote" "$base_branch"; then
+    if git pull --ff-only "$remote" "refs/heads/$base_branch"; then
       print_success "'$base_branch' is up to date."
       return 0
     fi
@@ -143,7 +143,7 @@ EOF
   fi
 
   print_info "Merging '$remote/$base_branch' into '$current_branch'..."
-  if git merge --no-edit "$remote/$base_branch"; then
+  if git merge --no-edit "refs/remotes/$remote/$base_branch"; then
     print_success "'$current_branch' is up to date with '$base_branch'."
   else
     local conflicts

package/docs/CONTRIBUTING.md

@@ -124,7 +124,7 @@ shellcheck -x bin/gitbash commands/*.sh
 ./bin/gitbash stale --all
 ```
 
-Tests live in `test/*.bats`. Each test gets its own temporary repository with a local bare remote (`test/helpers/setup.bash`). fzf is replaced by a stub that records its arguments and answers from a plan (`test/helpers/bin/fzf`); `test/fzf_real.bats` drives the real fzf in a pseudo-terminal. Add a test for every bug fix.
+Tests live in `test/*.bats`. Each test gets its own temporary repository with a local bare remote (`test/helpers/setup.bash`). fzf is replaced by a stub that records its arguments and answers from a plan (`test/helpers/bin/fzf`); `test/fzf_real.bats` drives the real fzf in a pseudo-terminal. Add a test for every bug fix. Write `[[ ... ]]` checks that are not the last line of a test as `[[ ... ]] || false`: bats running on bash 3.2 ignores a failing `[[ ]]` otherwise.
 
 CI runs shellcheck and the tests on Ubuntu (bash 5), macOS (bash 3.2 and 5) and Windows (Git Bash). Scripts must keep LF line endings (`.gitattributes` enforces it).
 

package/docs/SECURITY.md

@@ -18,7 +18,9 @@ Versions before 2.0 executed repository `.gitbashrc` files as shell code, so ope
 ## Trust Model
 
 - Configuration files (`~/.gitbashrc`, a repository's `.gitbashrc` and `.gitbashrc-user`) are **parsed, never executed**. Only plain `GITBASH_*="value"` lines from a fixed list of settings are read; values containing `$`, backticks, backslashes or quotes are rejected.
-- A repository's committed `.gitbashrc` is treated as untrusted: it cannot set `GITBASH_MERGE_COMMAND` (the only setting that names a program to run). That setting is only read from `~/.gitbashrc` and `.gitbashrc-user`.
+- A repository's committed `.gitbashrc` is treated as untrusted: it cannot set `GITBASH_MERGE_COMMAND` (the only setting that names a program to run). That setting is only read from `~/.gitbashrc` and an uncommitted `.gitbashrc-user`. A `.gitbashrc-user` that is tracked by git came with the repository and is treated like `.gitbashrc` (before 3.1.0 it was trusted, so a repository could choose the merge tool that `update` runs on conflicts).
+- A repository's `.gitbashrc` can add to `GITBASH_PROTECTED_BRANCHES`, but not remove branches that your own settings (or the default) protect.
+- A repository also cannot turn off update checks: `GITBASH_NO_UPDATE_CHECKS` is ignored in the committed `.gitbashrc` (and in a committed `.gitbashrc-user`).
 - Settings that reach git as arguments are validated: `GITBASH_BASE_BRANCH` (and a base branch taken from the remote's `HEAD`) must be a valid branch name that does not start with `-`, and `GITBASH_REMOTE` must not start with `-`. Before 3.0.0, a committed `.gitbashrc` could set `GITBASH_BASE_BRANCH="--output=<file>"` and make `switch` or `cleanup` overwrite that file.
 - `gitbash --init` prints wrapper functions that call the installed `gitbash` binary; command code is not sourced into your shell.
 - `pr` and `repo` never pass credentials from the remote URL to the browser.
@@ -28,7 +30,8 @@ Versions before 2.0 executed repository `.gitbashrc` files as shell code, so ope
 ## Releases
 
 - Releases are staged only by the Release workflow in GitHub Actions, with npm trusted publishing (OIDC, no long-lived npm token) and [provenance](https://docs.npmjs.com/generating-provenance-statements). A version goes live only after a maintainer approves it with 2FA ([staged publishing](https://docs.npmjs.com/staged-publishing/)); neither the workflow nor a leaked GitHub token can publish on its own. Check an installed copy with `npm audit signatures`.
-- The npm package is published before the GitHub release, which `gitbash --update` and the install script use.
+- The install script (`install.sh`) downloads that same npm package and installs it only if it matches the sha512 checksum npm records for the version. It keeps a copy of itself in the installation, and `gitbash --update` runs that copy, so a git tag cannot change what gets installed or run. (Before 3.1.0, `--update` downloaded `install.sh` from the release's git tag and ran it: whoever could create a GitHub release could run code on machines that updated a script install.)
+- `gitbash --update`, the update check and the install script take the latest version from npm's `latest` tag, which only moves when a maintainer approves a staged version. GitHub releases are not used for updates.
 - Third-party actions are pinned to commit SHAs and kept up to date by Dependabot; each workflow job gets only the permissions it needs.
 
 ---

package/install.sh

@@ -0,0 +1,171 @@
+#!/bin/sh
+# gitbash installer - installs gitbash without npm or node.
+#
+# Downloads the package published on npm (released only from GitHub Actions,
+# with provenance, after approval with 2FA) and checks it against the sha512
+# integrity npm records for that version before installing anything.
+#
+#   curl -fsSL https://raw.githubusercontent.com/jaggli/gitbash/main/install.sh | sh
+#   wget -qO- https://raw.githubusercontent.com/jaggli/gitbash/main/install.sh | sh
+#
+# Environment:
+#   GITBASH_VERSION      version to install, e.g. 3.0.0 or v3.0.0 (default: latest)
+#   GITBASH_INSTALL_DIR  where the files go (default: ${XDG_DATA_HOME:-~/.local/share}/gitbash)
+#   GITBASH_BIN_DIR      where the gitbash symlink goes (default: ~/.local/bin)
+#
+# Works in Git Bash on Windows, where a small launcher script replaces the symlink.
+#
+# Run it again, or 'gitbash --update' (which runs the installed copy of this
+# script), to upgrade.
+set -eu
+
+REGISTRY="https://registry.npmjs.org/gitbash"
+INSTALL_DIR="${GITBASH_INSTALL_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/gitbash}"
+BIN_DIR="${GITBASH_BIN_DIR:-$HOME/.local/bin}"
+
+say() { printf '%s\n' "$*"; }
+die() { printf 'gitbash install: %s\n' "$*" >&2; exit 1; }
+
+if command -v curl >/dev/null 2>&1; then
+    fetch() { curl -fsSL "$1"; }
+    fetch_to() { curl -fsSL -o "$2" "$1"; }
+elif command -v wget >/dev/null 2>&1; then
+    fetch() { wget -qO- "$1"; }
+    fetch_to() { wget -qO "$2" "$1"; }
+else
+    die "curl or wget is required"
+fi
+command -v tar >/dev/null 2>&1 || die "tar is required"
+command -v bash >/dev/null 2>&1 || die "bash is required to run gitbash"
+command -v git >/dev/null 2>&1 || say "Warning: git is not installed; gitbash needs git >= 2.23."
+
+# SHA-512 of a file, in hex
+sha512_hex() {
+    if command -v sha512sum >/dev/null 2>&1; then
+        sha512sum "$1" | cut -d ' ' -f 1
+    elif command -v shasum >/dev/null 2>&1; then
+        shasum -a 512 "$1" | cut -d ' ' -f 1
+    elif command -v openssl >/dev/null 2>&1; then
+        openssl dgst -sha512 "$1" | sed 's/.*= *//'
+    else
+        return 1
+    fi
+}
+
+# Base64 (npm's integrity format) to hex
+base64_to_hex() {
+    { printf '%s' "$1" | base64 -d 2>/dev/null ||
+      printf '%s' "$1" | base64 -D 2>/dev/null ||
+      printf '%s' "$1" | openssl base64 -d -A 2>/dev/null; } | od -An -v -tx1 | tr -d ' \n'
+}
+
+# A string field of npm's (single-line) version document
+json_field() {
+    # shellcheck disable=SC2020  # each of , { } becomes a newline
+    printf '%s' "$1" | tr ',{}' '\n\n\n' | sed -n "s/^\"$2\":\"\([^\"]*\)\"\$/\1/p" | head -n 1
+}
+
+# Returns 0 for a plain version number like 3.0.0 (digits and exactly two dots)
+valid_version() {
+    case "$1" in
+        *[!0-9.]*|.*|*.|*..*|*.*.*.*) return 1 ;;
+        *.*.*) return 0 ;;
+    esac
+    return 1
+}
+
+# Resolve the version, then read its tarball URL and checksum from npm
+version="${GITBASH_VERSION:-latest}"
+version="${version#v}"
+if [ "$version" != latest ] && ! valid_version "$version"; then
+    die "invalid GITBASH_VERSION '$version' (use e.g. 3.0.0)"
+fi
+if [ "$version" = latest ]; then
+    # Not the version document's "version": its npm scripts have one too
+    tags="$(fetch "https://registry.npmjs.org/-/package/gitbash/dist-tags")" ||
+        die "could not look up the latest version on npm (set GITBASH_VERSION to pick one)"
+    version="$(json_field "$tags" latest)"
+    valid_version "$version" ||
+        die "could not look up the latest version on npm (set GITBASH_VERSION to pick one)"
+fi
+meta="$(fetch "$REGISTRY/$version")" || die "could not find gitbash $version on npm"
+tarball="$(json_field "$meta" tarball)"
+integrity="$(json_field "$meta" integrity)"
+case "$tarball" in
+    "$REGISTRY/-/gitbash-$version.tgz") ;;
+    *) die "unexpected package location '$tarball'" ;;
+esac
+case "$integrity" in
+    sha512-?*) ;;
+    *) die "npm has no sha512 checksum for gitbash $version" ;;
+esac
+
+# Refuse to replace a directory that is not a gitbash install
+if [ -e "$INSTALL_DIR" ] && [ ! -f "$INSTALL_DIR/bin/gitbash" ]; then
+    die "$INSTALL_DIR exists and is not a gitbash install; set GITBASH_INSTALL_DIR to another location"
+fi
+
+tmp="$(mktemp -d 2>/dev/null || mktemp -d -t gitbash)"
+trap 'rm -rf "$tmp"' EXIT INT TERM
+
+say "Downloading gitbash $version..."
+fetch_to "$tarball" "$tmp/gitbash.tgz" || die "download failed"
+
+# Nothing is unpacked before the checksum matches
+expected="$(base64_to_hex "${integrity#sha512-}")"
+actual="$(sha512_hex "$tmp/gitbash.tgz")" || die "sha512sum, shasum or openssl is required to verify the download"
+if [ -z "$expected" ] || [ "$actual" != "$expected" ]; then
+    die "checksum mismatch for gitbash $version: the download was not installed"
+fi
+say "Verified sha512 checksum."
+
+mkdir "$tmp/src"
+tar -xzf "$tmp/gitbash.tgz" -C "$tmp/src"
+src="$tmp/src/package"
+[ -f "$src/bin/gitbash" ] || die "unexpected package layout"
+
+# Copy only what gitbash needs at runtime
+mkdir "$tmp/install"
+cp -R "$src/bin" "$src/commands" "$src/package.json" "$tmp/install/"
+[ -f "$src/LICENSE" ] && cp "$src/LICENSE" "$tmp/install/"
+# This version's verified installer: 'gitbash --update' runs it from here
+[ -f "$src/install.sh" ] && cp "$src/install.sh" "$tmp/install/"
+chmod +x "$tmp/install/bin/gitbash"
+# Tells 'gitbash --update' how gitbash was installed
+printf 'method=script\nbin_dir=%s\n' "$BIN_DIR" > "$tmp/install/.gitbash-install"
+
+mkdir -p "$(dirname "$INSTALL_DIR")" "$BIN_DIR"
+rm -rf "$INSTALL_DIR"
+mv "$tmp/install" "$INSTALL_DIR"
+rm -f "$BIN_DIR/gitbash"
+if ln -s "$INSTALL_DIR/bin/gitbash" "$BIN_DIR/gitbash" 2>/dev/null && [ -L "$BIN_DIR/gitbash" ]; then
+    linked="Linked $BIN_DIR/gitbash"
+else
+    # No symlinks (Git Bash on Windows copies the file instead): a launcher script
+    rm -f "$BIN_DIR/gitbash"
+    target="$(printf '%s' "$INSTALL_DIR/bin/gitbash" | sed "s/'/'\\\\''/g")"
+    printf '#!/bin/sh\nexec bash '"'"'%s'"'"' "$@"\n' "$target" > "$BIN_DIR/gitbash"
+    chmod +x "$BIN_DIR/gitbash"
+    linked="Created launcher $BIN_DIR/gitbash"
+fi
+
+say "Installed gitbash $version to $INSTALL_DIR"
+say "$linked"
+
+case ":$PATH:" in
+    *":$BIN_DIR:"*)
+        found="$(command -v gitbash 2>/dev/null || true)"
+        if [ -n "$found" ] && [ "$found" != "$BIN_DIR/gitbash" ]; then
+            say ""
+            say "Note: 'gitbash' currently resolves to $found, which comes before $BIN_DIR in PATH."
+        fi
+        ;;
+    *)
+        say ""
+        say "$BIN_DIR is not in your PATH. Add this to your .zshrc or .bashrc:"
+        say "  export PATH=\"$BIN_DIR:\$PATH\""
+        ;;
+esac
+
+say ""
+say "Next: run 'gitbash --config', and see the README for shell integration."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitbash",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Opinionated git utilities for bash with fzf-powered menus",
   "author": "jaggli",
   "license": "MIT",
@@ -30,6 +30,7 @@
     "bin/",
     "commands/",
     "docs/",
+    "install.sh",
     "README.md",
     "LICENSE"
   ],