Add cross-platform install script

[GodSpoon]

Summary

• Adds install.sh — one script for macOS, Linux, Windows (Git Bash/MSYS)
• Auto-detects OS, sets correct Tabby plugin dir, builds with webpack
• Uses --legacy-peer-deps for Angular conflicts, tarball install on Windows
• Adds one-liner to README via jsdelivr CDN

🤖 Generated with Claude Code

[a-rank]

Review: Add cross-platform install script

Thanks for the contribution! The install script is a nice convenience. However, there are a few concerns that should be addressed before merging.

Security: curl | bash one-liner points to the contributor's fork

The README one-liner pipes a script from cdn.jsdelivr.net/gh/GodSpoon/tabby-scroll-fix@add-install-script/install.sh directly into bash. This has two problems:

1. It points to the contributor's fork, not the upstream repo. After merging, the upstream repo would be directing users to execute a script hosted in a third-party fork — which the contributor can change at any time without review. This is a supply chain risk.
2. curl | bash is inherently risky and may not be appropriate for a small plugin like this. If kept, the URL should at minimum point to the upstream repo (e.g., a-rank/tabby-scroll-fix@master).

Recommendation: Either remove the one-liner entirely, or change the URL to point to the upstream repo after merging.

Script issues

1. install.sh won't work when piped from curl. When run as curl ... | bash, $0 is bash and dirname "$0" resolves to /usr/bin or similar — not the plugin source directory. The script assumes it's being run from a local clone (it references $SOURCE_PATH/dist, $SOURCE_PATH/package.json, etc.), so the one-liner will fail or produce confusing errors. Either the script needs to clone the repo first when detecting it's being piped, or the one-liner should be removed.

2. Tarball rename on Windows is fragile. The mv tabby-scroll-fix-*.tgz "$TARBALL" 2>/dev/null || mv tabby-scroll-fix.tgz "$TARBALL" 2>/dev/null || true chain silently swallows errors via || true. If both mv commands fail, the script continues and tries to npm install a nonexistent tarball. This should fail explicitly.

3. No package.json initialization in $PLUGIN_DIR. The manual install instructions in the README include npm init -y before npm install, but the script skips this step. If the plugins directory is fresh (no package.json), npm install may behave unexpectedly.

Minor

• The README changes demote "Build" to just part of "Install (manual)" which loses the subsection header structure. Consider keeping ### Build and ### Install into Tabby as sub-headers under "Install (manual)".

Summary

The core idea is useful, but the curl | bash one-liner pointing to a fork is a blocker, and the script doesn't actually work when piped from curl. Please address these before merging.

---

Generated by Claude Code