vigthoria-cli 1.13.20 → 1.13.23

package/dist/utils/workspace-cache.js

@@ -9,6 +9,9 @@
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { isSensitivePath } from './secret-policy.js';
+import { DurableJsonStore } from './durable-json.js';
+import { resolveWorkspacePath } from './workspace-boundary.js';
 const CACHE_SUBDIR = '.vigthoria';
 const CACHE_FILENAME = 'file-hashes.json';
 function getCachePath(workspacePath) {
@@ -24,20 +27,37 @@ function hashFile(absPath) {
 }
 function loadCache(workspacePath) {
     try {
-        return JSON.parse(fs.readFileSync(getCachePath(workspacePath), 'utf-8'));
+        return cacheStore(workspacePath).read();
     }
     catch {
         return {};
     }
 }
 function persistCache(workspacePath, hashes) {
+    cacheStore(workspacePath).update((current) => ({ ...current, ...hashes }));
+}
+function cacheStore(workspacePath) {
+    const isHashMap = (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value)
+        && Object.entries(value).every(([key, hash]) => (Boolean(key) && typeof hash === 'string' && /^[a-f0-9]{64}$/i.test(hash))));
+    return new DurableJsonStore({
+        filePath: getCachePath(workspacePath),
+        schemaVersion: 1,
+        defaultValue: () => ({}),
+        validate: isHashMap,
+        migrate: (value) => isHashMap(value) ? value : {},
+    });
+}
+function resolveTrackedFile(workspacePath, candidate) {
     try {
-        const cacheDir = path.join(workspacePath, CACHE_SUBDIR);
-        if (!fs.existsSync(cacheDir))
-            fs.mkdirSync(cacheDir, { recursive: true });
-        fs.writeFileSync(getCachePath(workspacePath), JSON.stringify(hashes, null, 2), 'utf-8');
+        const absolutePath = resolveWorkspacePath(workspacePath, candidate, { allowAbsoluteInsideRoot: true });
+        const key = path.relative(fs.realpathSync(workspacePath), absolutePath).replace(/\\/g, '/');
+        if (!key || key.startsWith('../') || isSensitivePath(key))
+            return null;
+        return { absolutePath, key };
+    }
+    catch {
+        return null;
     }
-    catch { /* non-fatal */ }
 }
 /**
  * Partition file paths into changed and unchanged sets.
@@ -50,17 +70,18 @@ export function getChangedFiles(workspacePath, relativePaths) {
     const changed = [];
     const unchanged = [];
     for (const rel of relativePaths) {
-        const abs = path.isAbsolute(rel) ? rel : path.join(workspacePath, rel);
-        const key = path.relative(workspacePath, abs).replace(/\\/g, '/');
-        const currentHash = hashFile(abs);
-        if (!currentHash || cache[key] !== currentHash) {
+        const tracked = resolveTrackedFile(workspacePath, rel);
+        if (!tracked)
+            continue;
+        const currentHash = hashFile(tracked.absolutePath);
+        if (!currentHash || cache[tracked.key] !== currentHash) {
             changed.push(rel);
         }
         else {
             unchanged.push(rel);
         }
     }
-    return { changed, unchanged, total: relativePaths.length };
+    return { changed, unchanged, total: changed.length + unchanged.length };
 }
 /**
  * Write current hashes for the given files into the persistent cache.
@@ -71,11 +92,12 @@ export function updateWorkspaceCache(workspacePath, relativePaths) {
         return;
     const cache = loadCache(workspacePath);
     for (const rel of relativePaths) {
-        const abs = path.isAbsolute(rel) ? rel : path.join(workspacePath, rel);
-        const key = path.relative(workspacePath, abs).replace(/\\/g, '/');
-        const hash = hashFile(abs);
+        const tracked = resolveTrackedFile(workspacePath, rel);
+        if (!tracked)
+            continue;
+        const hash = hashFile(tracked.absolutePath);
         if (hash)
-            cache[key] = hash;
+            cache[tracked.key] = hash;
     }
     persistCache(workspacePath, cache);
 }

package/dist/utils/workspace-stream.js

@@ -22,7 +22,10 @@ import fs from 'fs';
 import path from 'path';
 import WebSocket from 'ws';
 import { Logger } from './logger.js';
-import { joinV3WorkspacePath, normalizeV3WorkspaceRelativePath } from './v3-workspace-path.js';
+import { normalizeV3WorkspaceRelativePath } from './v3-workspace-path.js';
+import { assertTrustedWebSocketEndpoint } from './network-policy.js';
+import { resolveWorkspacePath } from './workspace-boundary.js';
+import { containsHighConfidenceSecret, isSensitivePath } from './secret-policy.js';
 const logger = new Logger();
 logger.setVerbose(!!process.env.VIGTHORIA_DEBUG);
 // Files/dirs to ignore in the watcher
@@ -36,6 +39,12 @@ const IGNORE_PATTERNS = [
     '**/.next/**',
     '**/.cache/**',
     '**/.vigthoria/**',
+    '**/.env',
+    '**/.env.*',
+    '**/credentials*',
+    '**/secrets*',
+    '**/*.pem',
+    '**/*.key',
     '**/coverage/**',
     '**/*.pyc',
     // CRITICAL: Windows AppData & system directories (prevents EPERM errors)
@@ -80,10 +89,15 @@ export function applyFileMutation(event, workspaceRoot) {
         logger.warn(`Refusing to apply mutation with invalid path: ${event.path}`);
         return false;
     }
-    const absPath = joinV3WorkspacePath(workspaceRoot, relativePath);
-    const resolvedRoot = path.resolve(workspaceRoot);
-    // Safety: ensure the resolved path is within the workspace
-    if (!absPath.startsWith(resolvedRoot + path.sep) && absPath !== resolvedRoot) {
+    if (isSensitivePath(relativePath)) {
+        logger.warn(`Refusing to apply mutation to sensitive path: ${path.basename(relativePath)}`);
+        return false;
+    }
+    let absPath;
+    try {
+        absPath = resolveWorkspacePath(workspaceRoot, relativePath, { allowMissing: event.action !== 'delete' });
+    }
+    catch {
         logger.warn(`Refusing to apply mutation outside workspace: ${event.path}`);
         return false;
     }
@@ -115,7 +129,7 @@ export class WorkspaceWatcher {
     onFileChange;
     _ready = false;
     constructor(options) {
-        this.workspaceRoot = path.resolve(options.workspaceRoot);
+        this.workspaceRoot = fs.realpathSync(path.resolve(options.workspaceRoot));
         this.onFileChange = options.onFileChange;
     }
     start() {
@@ -132,6 +146,7 @@ export class WorkspaceWatcher {
                 interval: 100,
                 binaryInterval: 300,
                 depth: 50, // Limit traversal depth
+                followSymlinks: false,
             });
             this.watcher
                 .on('ready', () => {
@@ -183,9 +198,16 @@ export class WorkspaceWatcher {
         const ext = path.extname(filePath).toLowerCase();
         if (BINARY_EXTENSIONS.has(ext))
             return;
-        const relativePath = path.relative(this.workspaceRoot, filePath);
-        if (relativePath.startsWith('..'))
-            return; // safety
+        const relativePath = path.relative(this.workspaceRoot, filePath).replace(/\\/g, '/');
+        if (isSensitivePath(relativePath))
+            return;
+        try {
+            resolveWorkspacePath(this.workspaceRoot, relativePath, { allowMissing: action === 'delete' });
+        }
+        catch {
+            logger.warn(`Refusing to synchronize path outside workspace: ${relativePath}`);
+            return;
+        }
         if (action === 'delete') {
             this.onFileChange?.(relativePath, null, 'delete');
             return;
@@ -195,6 +217,8 @@ export class WorkspaceWatcher {
             if (stat.size > MAX_SYNC_FILE_BYTES)
                 return;
             const content = fs.readFileSync(filePath, 'utf8');
+            if (containsHighConfidenceSecret(content))
+                return;
             this.onFileChange?.(relativePath, content, 'write');
         }
         catch {
@@ -216,7 +240,8 @@ export class WorkspaceWSClient {
         if (this.ws)
             return;
         const url = `${this.opts.serverUrl}/ws/workspace`;
-        this.ws = new WebSocket(url);
+        assertTrustedWebSocketEndpoint(url, 'v3', Boolean(this.opts.token));
+        this.ws = new WebSocket(url, { handshakeTimeout: 10_000 });
         this.ws.on('open', () => {
             this._connected = true;
             this._send({

package/install.ps1

@@ -8,26 +8,44 @@ $ErrorActionPreference = "Stop"
 $CLI_VERSION = "1.13.20"
 $INSTALL_DIR = "$env:USERPROFILE\.vigthoria"
 $NPM_PACKAGE = "vigthoria-cli"
-$GIT_PACKAGE_URL = "git+https://market.vigthoria.io/vigthoria/vigthoria-cli.git"
 $MANIFEST_URL = "https://extension.vigthoria.io/downloads/manifest.json"
 $HOSTED_TARBALL_URL = "https://extension.vigthoria.io/downloads/vigthoria-cli-$CLI_VERSION.tgz"
+$HOSTED_TARBALL_SHA256 = ""
+$RELEASE_RESOLVER = Join-Path $PSScriptRoot "scripts\release\resolve-release-manifest.mjs"
+$RELEASE_INSTALLER = Join-Path $PSScriptRoot "scripts\release\install-release.mjs"
+
+function Assert-TrustedReleaseUrl([string]$Value) {
+    $allowed = @(
+        "extension.vigthoria.io", "landing.vigthoria.io", "cli.vigthoria.io",
+        "coder.vigthoria.io", "market.vigthoria.io", "registry.npmjs.org"
+    )
+    try { $uri = [Uri]$Value } catch { throw "Invalid release URL" }
+    if ($uri.Scheme -ne "https" -or -not $uri.IsDefaultPort -or $uri.UserInfo -or $allowed -notcontains $uri.DnsSafeHost.ToLowerInvariant() -or $Value.Contains("\")) {
+        throw "Release URL must use HTTPS on an exact approved host and port"
+    }
+    return $uri.AbsoluteUri
+}
 
 function Resolve-ReleaseManifest {
+    # The hosted path is enabled only when the packaged shared policy verifier
+    # can validate strict metadata and the detached Ed25519 signature.
+    if (-not (Test-Path $RELEASE_RESOLVER)) { return }
     try {
-        $manifest = Invoke-WebRequest -Uri $MANIFEST_URL -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop |
-            Select-Object -ExpandProperty Content |
-            ConvertFrom-Json
-        $stable = $manifest.channels.stable
-        if ($stable.version) {
-            $script:CLI_VERSION = [string]$stable.version
+        $trustedManifest = Assert-TrustedReleaseUrl $MANIFEST_URL
+        $resolvedJson = & node $RELEASE_RESOLVER $trustedManifest stable
+        if ($LASTEXITCODE -ne 0) { throw "release resolver exited with status $LASTEXITCODE" }
+        $resolved = $resolvedJson | ConvertFrom-Json
+        if ($resolved.version) {
+            $script:CLI_VERSION = [string]$resolved.version
+        }
+        if ($resolved.url) {
+            $script:HOSTED_TARBALL_URL = Assert-TrustedReleaseUrl ([string]$resolved.url)
         }
-        if ($stable.url) {
-            $script:HOSTED_TARBALL_URL = [string]$stable.url
-        } elseif ($stable.version) {
-            $script:HOSTED_TARBALL_URL = "https://extension.vigthoria.io/downloads/vigthoria-cli-$($stable.version).tgz"
+        if ($resolved.sha256 -and ([string]$resolved.sha256) -match '^[a-fA-F0-9]{64}$') {
+            $script:HOSTED_TARBALL_SHA256 = ([string]$resolved.sha256).ToLowerInvariant()
         }
     } catch {
-        Write-Host "Release manifest unavailable, using bundled fallback $CLI_VERSION" -ForegroundColor Yellow
+        Write-Host "Signed release manifest unavailable, using exact pinned fallback $CLI_VERSION" -ForegroundColor Yellow
     }
 }
 
@@ -48,7 +66,8 @@ function Test-NetworkConnectivity {
     Write-Host "[CHECK] Checking network connectivity..." -ForegroundColor Yellow
 
     try {
-        $response = Invoke-WebRequest -Uri $HOSTED_TARBALL_URL -Method Head -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
+        $trustedTarball = Assert-TrustedReleaseUrl $HOSTED_TARBALL_URL
+        $response = Invoke-WebRequest -Uri $trustedTarball -Method Head -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 10 -ErrorAction Stop
         Write-Host "[OK] Hosted CLI package is reachable" -ForegroundColor Green
         return $true
     }
@@ -57,7 +76,7 @@ function Test-NetworkConnectivity {
     }
 
     try {
-        $response = Invoke-WebRequest -Uri "https://registry.npmjs.org/vigthoria-cli" -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
+        $response = Invoke-WebRequest -Uri "https://registry.npmjs.org/vigthoria-cli" -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 10 -ErrorAction Stop
         Write-Host "[OK] npm registry is reachable" -ForegroundColor Green
         return $true
     }
@@ -110,35 +129,78 @@ function Test-Prerequisites {
     return $true
 }
 
+function Get-VigthoriaTempRoot {
+    $explicitRoot = $env:VIGTHORIA_TEMP_DIR
+    $candidate = if ($explicitRoot) { $explicitRoot } else { Join-Path $env:USERPROFILE ".vigthoria\tmp" }
+    if (-not [IO.Path]::IsPathRooted($candidate)) { throw "VIGTHORIA_TEMP_DIR must be an absolute local path" }
+    if ($candidate.StartsWith("\\") -or $candidate.StartsWith("\\?\") -or $candidate.StartsWith("\\.\")) {
+        throw "VIGTHORIA_TEMP_DIR cannot use a UNC or Windows device path"
+    }
+    $fullRoot = [IO.Path]::GetFullPath($candidate).TrimEnd([IO.Path]::DirectorySeparatorChar)
+    $volumeRoot = [IO.Path]::GetPathRoot($fullRoot).TrimEnd([IO.Path]::DirectorySeparatorChar)
+    if ($fullRoot -eq $volumeRoot -or $fullRoot -eq [IO.Path]::GetTempPath().TrimEnd([IO.Path]::DirectorySeparatorChar)) {
+        throw "Refusing shared or filesystem-root temporary storage"
+    }
+    New-Item -ItemType Directory -Path $fullRoot -Force -ErrorAction Stop | Out-Null
+    $cursor = Get-Item -LiteralPath $fullRoot -Force -ErrorAction Stop
+    while ($cursor) {
+        if (($cursor.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+            throw "Refusing a reparse-point temporary storage path"
+        }
+        if ($cursor.FullName -eq [IO.Path]::GetPathRoot($cursor.FullName)) { break }
+        $cursor = $cursor.Parent
+    }
+    if (-not $explicitRoot) {
+        $homeRoot = [IO.Path]::GetFullPath($env:USERPROFILE).TrimEnd([IO.Path]::DirectorySeparatorChar)
+        if (-not ($fullRoot.Equals($homeRoot, [StringComparison]::OrdinalIgnoreCase) -or $fullRoot.StartsWith($homeRoot + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase))) {
+            throw "Default temporary storage escaped the user profile"
+        }
+    }
+    return $fullRoot
+}
+
 function Install-VigthoriaCLI-NPM {
     Write-Host ""
     Write-Host "[INSTALL] Installing Vigthoria CLI..." -ForegroundColor Cyan
 
-    try {
-        npm install -g $HOSTED_TARBALL_URL
-        Write-Host "[OK] Vigthoria CLI installed successfully!" -ForegroundColor Green
-        return $true
-    }
-    catch {
-        Write-Host "[WARN] Hosted package install failed, trying npm registry..." -ForegroundColor Yellow
+    if ($HOSTED_TARBALL_SHA256) {
+        $releaseTemp = Join-Path (Get-VigthoriaTempRoot) ("install-" + [Guid]::NewGuid().ToString("N"))
+        $releaseArchive = Join-Path $releaseTemp "candidate.tgz"
+        try {
+            New-Item -ItemType Directory -Path $releaseTemp -Force | Out-Null
+            $trustedTarball = Assert-TrustedReleaseUrl $HOSTED_TARBALL_URL
+            Invoke-WebRequest -Uri $trustedTarball -OutFile $releaseArchive -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 60 -ErrorAction Stop
+            $actualSha256 = (Get-FileHash -Path $releaseArchive -Algorithm SHA256).Hash.ToLowerInvariant()
+            if ($actualSha256 -ne $HOSTED_TARBALL_SHA256) { throw "Release checksum mismatch" }
+            if (-not (Test-Path $RELEASE_INSTALLER)) { throw "Transactional release installer is unavailable" }
+            & node $RELEASE_INSTALLER $releaseArchive $CLI_VERSION
+            if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
+            Write-Host "[OK] Vigthoria CLI installed from the checksum-verified release!" -ForegroundColor Green
+            return $true
+        }
+        catch {
+            Write-Host "[WARN] Verified hosted package install failed, trying npm registry: $_" -ForegroundColor Yellow
+        }
+        finally {
+            if (Test-Path $releaseTemp) { Remove-Item -Recurse -Force $releaseTemp }
+        }
+    } else {
+        Write-Host "[WARN] Hosted package has no trusted manifest SHA-256; skipping direct URL installation." -ForegroundColor Yellow
     }
 
     try {
-        npm install -g vigthoria-cli
+        if (Test-Path $RELEASE_INSTALLER) {
+            & node $RELEASE_INSTALLER "$NPM_PACKAGE@$CLI_VERSION" $CLI_VERSION
+            if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
+        } else {
+            npm install -g --registry=https://registry.npmjs.org/ "$NPM_PACKAGE@$CLI_VERSION"
+            if ($LASTEXITCODE -ne 0) { throw "npm exited with status $LASTEXITCODE" }
+        }
         Write-Host "[OK] Vigthoria CLI installed successfully!" -ForegroundColor Green
         return $true
     }
     catch {
-        Write-Host "[WARN] npm registry install failed, trying git package..." -ForegroundColor Yellow
-    }
-
-    try {
-        npm install -g $GIT_PACKAGE_URL
-        Write-Host "[OK] Vigthoria CLI installed successfully from git package!" -ForegroundColor Green
-        return $true
-    }
-    catch {
-        Write-Host "[ERROR] Install failed (hosted package + npm registry + git package): $_" -ForegroundColor Red
+        Write-Host "[ERROR] Install failed: no checksum-verified artifact or exact npm release $CLI_VERSION is available: $_" -ForegroundColor Red
         return $false
     }
 }
@@ -146,58 +208,18 @@ function Install-VigthoriaCLI-NPM {
 function Install-VigthoriaCLI-Direct {
     Write-Host ""
     Write-Host "[INSTALL] Installing Vigthoria CLI (Direct Download)..." -ForegroundColor Cyan
-    
-    # Create install directory
-    if (-not (Test-Path $INSTALL_DIR)) {
-        New-Item -ItemType Directory -Path $INSTALL_DIR -Force | Out-Null
-    }
-    
-    $tarballUrl = $HOSTED_TARBALL_URL
-    $tarballPath = "$INSTALL_DIR\vigthoria-cli.tgz"
-    $extractPath = "$INSTALL_DIR\cli"
-    
+    $releaseTemp = Join-Path (Get-VigthoriaTempRoot) ("direct-" + [Guid]::NewGuid().ToString("N"))
+    $tarballPath = Join-Path $releaseTemp "candidate.tgz"
     try {
-        # Download tarball
-        Write-Host "  Downloading from $tarballUrl..." -ForegroundColor Gray
-        Invoke-WebRequest -Uri $tarballUrl -OutFile $tarballPath -UseBasicParsing
-        
-        # Extract
-        Write-Host "  Extracting..." -ForegroundColor Gray
-        if (Test-Path $extractPath) {
-            Remove-Item -Recurse -Force $extractPath
-        }
-        New-Item -ItemType Directory -Path $extractPath -Force | Out-Null
-        
-        # Use tar to extract (available in Windows 10+)
-        tar -xzf $tarballPath -C $extractPath
-        
-        # The tarball extracts to a 'package' folder
-        $packagePath = "$extractPath\package"
-        
-        # Install dependencies
-        Write-Host "  Installing dependencies..." -ForegroundColor Gray
-        Push-Location $packagePath
-        npm install --production
-        Pop-Location
-        
-        # Create batch file wrapper
-        $batContent = @"
-@echo off
-node "$packagePath\dist\index.js" %*
-"@
-        Set-Content -Path "$INSTALL_DIR\vigthoria.bat" -Value $batContent
-        Set-Content -Path "$INSTALL_DIR\vig.bat" -Value $batContent
-        
-        # Add to PATH if not already there
-        $userPath = [Environment]::GetEnvironmentVariable("PATH", "User")
-        if ($userPath -notlike "*$INSTALL_DIR*") {
-            [Environment]::SetEnvironmentVariable("PATH", "$userPath;$INSTALL_DIR", "User")
-            Write-Host "  Added $INSTALL_DIR to PATH" -ForegroundColor Gray
-        }
-        
-        # Cleanup
-        Remove-Item $tarballPath -Force
-        
+        if (-not $HOSTED_TARBALL_SHA256) { throw "Direct installation requires a signed manifest SHA-256" }
+        if (-not (Test-Path $RELEASE_INSTALLER)) { throw "Transactional release installer is unavailable" }
+        New-Item -ItemType Directory -Path $releaseTemp -ErrorAction Stop | Out-Null
+        $tarballUrl = Assert-TrustedReleaseUrl $HOSTED_TARBALL_URL
+        Invoke-WebRequest -Uri $tarballUrl -OutFile $tarballPath -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 60 -ErrorAction Stop
+        $actualSha256 = (Get-FileHash -Path $tarballPath -Algorithm SHA256).Hash.ToLowerInvariant()
+        if ($actualSha256 -ne $HOSTED_TARBALL_SHA256) { throw "Release checksum mismatch" }
+        & node $RELEASE_INSTALLER $tarballPath $CLI_VERSION
+        if ($LASTEXITCODE -ne 0) { throw "transactional installer exited with status $LASTEXITCODE" }
         Write-Host "[OK] Vigthoria CLI installed successfully!" -ForegroundColor Green
         return $true
     }
@@ -205,51 +227,8 @@ node "$packagePath\dist\index.js" %*
         Write-Host "[ERROR] Direct install failed: $_" -ForegroundColor Red
         return $false
     }
-}
-
-function Install-VigthoriaCLI-GitHub {
-    Write-Host ""
-    Write-Host "[INSTALL] Installing Vigthoria CLI (from Vigthoria Market)..." -ForegroundColor Cyan
-    
-    # Create install directory
-    if (-not (Test-Path $INSTALL_DIR)) {
-        New-Item -ItemType Directory -Path $INSTALL_DIR -Force | Out-Null
-    }
-    
-    $clonePath = "$INSTALL_DIR\cli"
-    
-    try {
-        # Check if git is available
-        $gitVersion = git --version 2>$null
-        if (-not $gitVersion) {
-            Write-Host "[ERROR] Git is not installed" -ForegroundColor Red
-            return $false
-        }
-        
-        # Clone repository
-        if (Test-Path $clonePath) {
-            Remove-Item -Recurse -Force $clonePath
-        }
-        
-        Write-Host "  Cloning from Vigthoria Market..." -ForegroundColor Gray
-        git clone --depth 1 https://market.vigthoria.io/vigthoria/vigthoria-cli.git $clonePath
-        
-        # Install and build
-        Push-Location $clonePath
-        Write-Host "  Installing dependencies..." -ForegroundColor Gray
-        npm install
-        Write-Host "  Building..." -ForegroundColor Gray
-        npm run build
-        Write-Host "  Linking globally..." -ForegroundColor Gray
-        npm link
-        Pop-Location
-        
-        Write-Host "[OK] Vigthoria CLI installed successfully!" -ForegroundColor Green
-        return $true
-    }
-    catch {
-        Write-Host "[ERROR] Git install failed: $_" -ForegroundColor Red
-        return $false
+    finally {
+        if (Test-Path $releaseTemp) { Remove-Item -Recurse -Force $releaseTemp }
     }
 }
 
@@ -268,17 +247,13 @@ function Show-NetworkTroubleshooting {
     Write-Host "   npm config set proxy http://proxy.company.com:8080" -ForegroundColor Gray
     Write-Host "   npm config set https-proxy http://proxy.company.com:8080" -ForegroundColor Gray
     Write-Host ""
-    Write-Host "3. Try a different npm registry:" -ForegroundColor Cyan
-    Write-Host "   npm config set registry https://registry.npmmirror.com" -ForegroundColor Gray
-    Write-Host ""
-    Write-Host "4. Check Windows Firewall/Antivirus settings" -ForegroundColor Cyan
+    Write-Host "3. Check Windows Firewall/Antivirus settings" -ForegroundColor Cyan
     Write-Host ""
-    Write-Host "5. Try using a VPN" -ForegroundColor Cyan
+    Write-Host "4. Try using a VPN" -ForegroundColor Cyan
     Write-Host ""
-    Write-Host "6. Manual download alternatives:" -ForegroundColor Cyan
+    Write-Host "5. Manual download alternative:" -ForegroundColor Cyan
     Write-Host "   Hosted package: $HOSTED_TARBALL_URL" -ForegroundColor Gray
     Write-Host "   npm package: https://www.npmjs.com/package/vigthoria-cli" -ForegroundColor Gray
-    Write-Host "   git package: $GIT_PACKAGE_URL" -ForegroundColor Gray
     Write-Host ""
 }
 
@@ -325,21 +300,19 @@ if ($networkOk) {
 # Network failed or npm install failed
 Show-NetworkTroubleshooting
 
-Write-Host "Would you like to try alternative installation methods?" -ForegroundColor Yellow
-$choice = Read-Host "Enter 'y' to try direct download, 'g' for git clone, or 'n' to exit"
+Write-Host "Would you like to try the checksum-verified direct download?" -ForegroundColor Yellow
+$choice = Read-Host "Enter 'y' to try direct download or 'n' to exit"
 
 switch ($choice.ToLower()) {
     'y' {
         if (Install-VigthoriaCLI-Direct) {
             Show-Success
+            exit 0
         }
-    }
-    'g' {
-        if (Install-VigthoriaCLI-GitHub) {
-            Show-Success
-        }
+        exit 1
     }
     default {
         Write-Host "Installation cancelled." -ForegroundColor Gray
+        exit 1
     }
 }