Fix/installer by yeabwang · Pull Request #21 · yeabwang/pichu

yeabwang · 2026-02-21T06:03:03Z

Summary

fixing the one installer

Copilot

Pull request overview

This pull request refactors the Windows installation scripts to improve flexibility and reliability. The main change is removing the automatic installation of uv and instead supporting multiple package managers (uv, pipx, pip3, pip) with a fallback chain. The install.cmd script now also supports downloading the PowerShell script from GitHub if a local copy isn't available.

Changes:

Modified Select-Installer to detect available package managers instead of auto-installing uv
Enhanced Install-Pichu to support multiple installers (uv, pipx, pip3, pip) with appropriate command syntax for each
Added defensive property checks in Get-CommandPath to handle different command object types
Updated install.cmd to support both local and remote script execution with automatic fallback

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

File	Description
install.ps1	Refactored installer selection to support multiple package managers; added defensive checks for command properties; added exit code validation
install.cmd	Added logic to download and execute remote install.ps1 if local copy doesn't exist; improved error handling and temp file cleanup

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

yeabwang · 2026-02-21T06:11:18Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2026-02-21T06:11:25Z

@yeabwang I've opened a new pull request, #22, to work on those changes. Once the pull request is ready, I'll request review from you.

yeabwang · 2026-02-21T08:08:57Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-21T08:13:51Z

+## [0.1.3] - 2026-02-21
+
+### Security
+- fixed one line installers security issues.


Changelog entry is grammatically incorrect and inconsistent with the style of the rest of the file. Consider: "Fixed one-line installer security issues." (capitalization + hyphenation, and no trailing period if following the existing bullet style).

Suggested change

- fixed one line installers security issues.

- Fixed one-line installer security issues.

Copilot · 2026-02-21T08:13:51Z


-Ensure-PathEntry -Dir $pathTargetDir -Skip:$NoModifyPath
-Ensure-AliasEntry $Alias
+Set-PathEntry -Dir $pathTargetDir -Skip:($NoModifyPath.IsPresent)


This call uses $NoModifyPath.IsPresent, but $NoModifyPath may have been reassigned from the env var to a Boolean earlier, which would make .IsPresent throw at runtime. Pass a boolean explicitly (e.g., -Skip:$NoModifyPath or -Skip:$skip) instead of dereferencing .IsPresent here.

Suggested change

Set-PathEntry -Dir $pathTargetDir -Skip:($NoModifyPath.IsPresent)

Set-PathEntry -Dir $pathTargetDir -Skip:$NoModifyPath

Copilot · 2026-02-21T08:13:52Z

    if [ "$SHELL_KIND" = "fish" ]; then
-        printf 'fish_add_path "%s"' "$escaped_path"
+        printf "fish_add_path '%s'" "$safe_dir"
    else
-        printf 'export PATH="%s:$PATH"' "$escaped_path"
+        printf "export PATH='%s:\$PATH'" "$safe_dir"
    fi


get_path_command emits export PATH='...:$PATH' using single quotes, so $PATH will not expand when sourced and PATH will be set to a literal string containing $PATH. Use quoting that preserves expansion of the existing PATH (e.g., double quotes or concatenated quoting).

Copilot · 2026-02-21T08:13:52Z

        printf '%s\n' "$path_cmd"
        printf '# <<< pichu path <<<\n'
-    } >>"$PROFILE_FILE"
+    } > "$tmp"


With set -o noclobber enabled, this } > "$tmp" write will fail because mktemp already created the file. Use a clobber-override redirect (>|) or temporarily disable noclobber for this write.

Copilot · 2026-02-21T08:13:52Z

+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+# ── Honour env override for NoModifyPath ─────────────────────────────────────
+if ($env:PICHU_NO_MODIFY_PATH -eq '1') { $NoModifyPath = $true }


$NoModifyPath is set to $true based on the PICHU_NO_MODIFY_PATH env var. Since PowerShell variables are not type-fixed, this can turn $NoModifyPath into a plain Boolean, which later breaks usages of $NoModifyPath.IsPresent. Prefer computing a separate $skip Boolean (or keep $NoModifyPath as a SwitchParameter) and avoid relying on .IsPresent after reassignment.

Suggested change

if ($env:PICHU_NO_MODIFY_PATH -eq '1') { $NoModifyPath = $true }

if ($env:PICHU_NO_MODIFY_PATH -eq '1') { [System.Management.Automation.SwitchParameter]$NoModifyPath = $true }

Copilot · 2026-02-21T08:13:52Z

+powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass ^
+    -File "%REMOTE_SCRIPT%"


The downloaded install.ps1 invocation does not forward %*, so CMD arguments are dropped. Append %* after the -File invocation to preserve passed arguments.

Copilot · 2026-02-21T08:13:52Z

            printf 'end\n'
            printf '# <<< pichu alias <<<\n'
-        } >>"$PROFILE_FILE"
+        } > "$tmp"


Same issue as above: mktemp creates $tmp, and set -o noclobber makes > "$tmp" fail. Use >| or disable noclobber around this redirect.

Copilot · 2026-02-21T08:13:52Z

+        printf "alias %s='%s'\n" "$REQUESTED_ALIAS" "$safe_target"
        printf '# <<< pichu alias <<<\n'
-    } >>"$PROFILE_FILE"
+    } > "$tmp"


Same issue as above: mktemp creates $tmp, and set -o noclobber makes > "$tmp" fail. Use >| or disable noclobber around this redirect.

Copilot · 2026-02-21T08:13:53Z

+if exist "%LOCAL_SCRIPT%" (
+    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass ^
+        -File "%LOCAL_SCRIPT%"
+    exit /b %errorlevel%


The local install.ps1 invocation does not forward %*, so CMD arguments are dropped (regression vs previous version). Append %* after the -File invocation so users can pass through PowerShell parameters.

yeabwang added 2 commits February 21, 2026 05:52

installer fix

025f8b8

Merge remote-tracking branch 'origin/main' into fix/installer

47138e3

Copilot AI review requested due to automatic review settings February 21, 2026 06:03

Copilot started reviewing on behalf of yeabwang February 21, 2026 06:03 View session

Copilot AI reviewed Feb 21, 2026

View reviewed changes

Update install.ps1

e4128bb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI mentioned this pull request Feb 21, 2026

Fix/installer: harden install.ps1 and install.cmd based on review feedback #22

Closed

13 tasks

yeabwang added 4 commits February 21, 2026 07:55

security fix

0e7669d

doc update

da3e330

doc update

e6f3b6f

update version

cbf1e3d

yeabwang requested a review from Copilot February 21, 2026 08:08

Copilot started reviewing on behalf of yeabwang February 21, 2026 08:08 View session

yeabwang closed this Feb 21, 2026

yeabwang reopened this Feb 21, 2026

yeabwang merged commit 91e1452 into main Feb 21, 2026
17 checks passed

Copilot AI reviewed Feb 21, 2026

View reviewed changes

	- fixed one line installers security issues.
	- Fixed one-line installer security issues.

	Set-PathEntry -Dir $pathTargetDir -Skip:($NoModifyPath.IsPresent)
	Set-PathEntry -Dir $pathTargetDir -Skip:$NoModifyPath

	if ($env:PICHU_NO_MODIFY_PATH -eq '1') { $NoModifyPath = $true }
	if ($env:PICHU_NO_MODIFY_PATH -eq '1') { [System.Management.Automation.SwitchParameter]$NoModifyPath = $true }

		powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass ^
		-File "%REMOTE_SCRIPT%"

Conversation

yeabwang commented Feb 21, 2026

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yeabwang commented Feb 21, 2026

Uh oh!

Copilot AI commented Feb 21, 2026

Uh oh!

yeabwang commented Feb 21, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants