Fix/installer: harden install.ps1 and install.cmd based on review feedback

[Copilot]

Addresses a set of robustness and correctness issues in the Windows installer scripts surfaced during code review.

Summary

• Type of Change: Bug fix / Chore

Fixes missing reinstall/upgrade flags, a null-deref risk in path resolution, misleading error messaging, and fragile temp-file handling in the CMD fallback.

install.ps1

• Get-CommandPath: guard $command.Definition against null/whitespace before passing to Test-Path
• Select-Installer error: updated to list all supported managers (uv, pipx, pip3, pip) instead of only uv
• pipx install: added --force to allow reinstall/repair
• pip3/pip install: added --upgrade --user to allow updates when already installed
• Exit check: $LASTEXITCODE -ne 0 -or -not $? to catch both native-exe and PowerShell-level failures

install.cmd

• Branch override: respects PICHU_INSTALL_BRANCH env var (defaults to main), enabling pinning for CI or fork testing
• Temp filename: three %RANDOM% tokens instead of two + locale-sensitive %TIME% substring
• Cleanup: replaced -File + post-hoc del with a PowerShell -Command try-finally block so the temp file is removed even on abnormal exit (Ctrl+C, crash)

Type of Change

• Bug fix
• Feature
• Refactor
• Docs
• Tests
• Chore

Validation

• Tests pass locally
• Lint/type checks pass locally
• Manual verification completed (if applicable)

Related Issues

Checklist

• Scope is focused and minimal
• Tests added/updated where needed
• Docs updated where needed
• No secrets or sensitive data included

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR hardens the Windows installer entrypoints by improving installer selection/upgrade behavior in install.ps1 and making the CMD bootstrapper more robust for downloading and executing the PowerShell installer.

Changes:

• Hardened Get-CommandPath null/whitespace handling and improved installer selection error messaging in install.ps1.
• Added reinstall/upgrade flags for pipx/pip3/pip installs and tightened install failure detection in install.ps1.
• Added branch override support and revamped temp-script creation/execution/cleanup flow in install.cmd.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
install.ps1	Improves robustness of command path resolution, installer selection messaging, and reinstall/upgrade behavior.
install.cmd	Adds configurable download branch and changes execution model intended to ensure temp script cleanup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The -Command wrapper runs the downloaded script in-process (& $scriptPath ...). Because install.ps1 uses exit (e.g., exit 0 for -Help and exit 1 on failure), an exit inside the script will terminate the PowerShell process before this wrapper’s finally executes, so the temp file may not be cleaned up (and the exit code handling becomes brittle). Consider invoking the script in a child PowerShell process inside the try (e.g., powershell -File $scriptPath ...) so the outer finally always runs, then propagate the child process exit code.

Suggested change

	powershell -NoProfile -ExecutionPolicy Bypass -Command "& { param([string]$scriptPath, [string[]]$scriptArgs) try { & $scriptPath @scriptArgs; exit $LASTEXITCODE } finally { Remove-Item -LiteralPath $scriptPath -ErrorAction SilentlyContinue } }" "%REMOTE_SCRIPT%" %*
	set "EXIT_CODE=%errorlevel%"
	powershell -NoProfile -ExecutionPolicy Bypass -File "%REMOTE_SCRIPT%" %*
	set "EXIT_CODE=%errorlevel%"
	del /Q "%REMOTE_SCRIPT%" >nul 2>&1

[Copilot]

PICHU_INSTALL_BRANCH is interpolated directly into a quoted URL. If it contains a double-quote or other metacharacters, it can break out of the quoted string and change the curl invocation (command injection / unexpected options). Please validate/sanitize PICHU_INSTALL_BRANCH to a safe branch/ref pattern (e.g., alphanumerics plus ._/-) before using it, or avoid direct interpolation by mapping known-safe values.

Suggested change

	if "%PICHU_INSTALL_BRANCH%"=="" set "PICHU_INSTALL_BRANCH=main"
	if "%PICHU_INSTALL_BRANCH%"=="" (
	set "PICHU_INSTALL_BRANCH=main"
	) else (
	rem Validate PICHU_INSTALL_BRANCH to avoid command injection via curl URL
	rem Allow only: A-Z, a-z, 0-9, dot (.), underscore (_), slash (/), hyphen (-)
	rem Additionally, disallow a leading '-' to prevent it from being interpreted as an option
	set "PICHU_BRANCH_CAND=%PICHU_INSTALL_BRANCH%"
	echo(%PICHU_BRANCH_CAND%| findstr /R /I "^[A-Za-z0-9._/][A-Za-z0-9._/-]*$" >nul
	if errorlevel 1 (
	echo Invalid PICHU_INSTALL_BRANCH value "%PICHU_INSTALL_BRANCH%".
	echo Allowed characters: A-Z, a-z, 0-9, dot (.), underscore (_), slash (/), hyphen (-), and it must not start with '-'.
	exit /b 1
	)
	)