Files
deepagents/libs/code/scripts
Mason Daugherty 9a5bbeb755 fix(code): harden installer downloads and paths (#4871)
The install script now respects the configured uv tool binary directory,
retries transient downloads, and avoids unsafe fallback files and broad
ownership changes. Existing installations that are current but shadowed
on `PATH` are reinstalled into the uv tool directory instead of being
incorrectly treated as up to date.

---

The installer previously assumed uv placed executables in
`~/.local/bin`, so custom uv configuration could make version detection,
verification, `PATH` setup, and ownership repair target the wrong files.
A single transient PyPI or uv bootstrap failure also immediately fell
back or failed, and predictable `/tmp` fallbacks were used when `mktemp`
was unavailable.

This resolves the tool bin through `uv tool dir --bin` with legacy
fallbacks, compares executable paths by inode, preserves existing
regular files when adding links, retries downloads three times, and
fails closed for required temporary files. Root and MDM installs avoid
running pre-existing user executables and narrow ownership changes to
paths created by the installer.

Regression tests cover custom and legacy uv bin locations, shadowed
installs, root execution, retries, and secure temporary-file failures.
2026-07-21 11:22:59 -04:00
..