install.sh: download the bun installer in full before running it

[ralyodio]

Piping the bun installer from curl straight into bash runs whatever arrived, even when the transfer is cut off. ThreatCrush flagged it (CWE-494, high) on the vendored copy in profullstack/cli-tools#118.

The installer is now downloaded in full first (curl -fsSL --retry 3 -o <tmp>) and then run with bash <tmp>. deploy-ssh tests: 14/14 pass. shellcheck is clean.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[github-actions]

ThreatCrush Security Scan

53 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 17 | LOW: 35

Severity	Rule	Location
HIGH	js-host-header-trust	packages/bots/wechat/src/index.ts:405
MEDIUM	redos-nested-quantifier	packages/actions-fleet-core/src/action-pack/schema.ts:3
MEDIUM	redos-nested-quantifier	packages/core/src/setup-helpers.ts:583
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/mysql.ts:133
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/postgres.ts:276
MEDIUM	sql-template-interpolation	packages/migrate/src/transforms.ts:178
MEDIUM	redos-nested-quantifier	packages/policy/src/rules/bundle-id.ts:3
MEDIUM	sql-string-concatenation	packages/targets/deploy-wordpress/src/index.ts:154
MEDIUM	redos-nested-quantifier	packages/targets/desktop-linux/src/index.ts:19
MEDIUM	redos-nested-quantifier	packages/targets/desktop-mac/src/index.ts:15
MEDIUM	redos-nested-quantifier	packages/targets/desktop-steamos/src/index.ts:28
MEDIUM	redos-nested-quantifier	packages/targets/mobile-android/src/index.ts:9
MEDIUM	redos-nested-quantifier	packages/targets/mobile-ios/src/index.ts:11
MEDIUM	redos-nested-quantifier	packages/targets/tv-androidtv/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-firetv/src/index.ts:13
MEDIUM	redos-nested-quantifier	packages/targets/tv-tvos/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-webos/src/index.ts:26
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/blog/[slug]/page.tsx:76
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:25
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:71
LOW	secret-generic-api-key	packages/affiliates/sovrn/src/index.ts:28
LOW	secret-generic-credential	packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99
LOW	js-nosql-injection	packages/ai/amazon-bedrock/src/index.test.ts:121
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:9
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:10
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:11
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:58
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:59
LOW	secret-generic-credential	packages/bridges/slack/src/index.test.ts:259
LOW	secret-generic-credential	packages/captcha/captchasolver/src/index.ts:34
LOW	secret-generic-credential	packages/cli/src/commands/secrets.ts:189
LOW	secret-generic-credential	packages/cloud/linode/src/index.ts:15
LOW	secret-generic-credential	packages/migrate/src/platforms/index.test.ts:116
LOW	secret-generic-credential	packages/observability/sentry/src/index.ts:15
LOW	secret-generic-credential	packages/outreach/producthunt/src/index.ts:103
LOW	secret-generic-credential	packages/promo/posthog/src/index.ts:23
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:35
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:40
LOW	secret-database-url	packages/scanners/threatcrush/test/scan-output.txt:54
LOW	secret-generic-credential	packages/security/snyk/src/index.ts:26
LOW	secret-generic-credential	packages/social/hashnode/src/index.ts:4
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:3
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:4
LOW	secret-generic-credential	packages/social/medium/src/index.ts:4
LOW	secret-generic-credential	packages/social/snapchat/src/index.ts:5
LOW	secret-generic-credential	packages/social/tiktok/src/index.ts:5
LOW	secret-generic-credential	packages/targets/plugin-vscode/src/index.test.ts:115
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.test.ts:79
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.ts:49
LOW	secret-generic-credential	packages/targets/sdk-pypi/src/index.test.ts:49

…and 3 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.