fix(cli): fail updates when installer download fails

[vicmcorrea]

Problem and fix

bend update returns 0 when curl fails because the last sh in curl | sh succeeds on empty input. A failed partial download can also execute its prefix.

Capture the installer in a shell variable and invoke sh only after curl succeeds: s=$(curl -fsSL ...) && printf '%s\n' "$s" | sh. This follows the maintainer's requested simplification, replacing the previous temporary-file implementation. The displayed command uses the same guarded download. Shell diagnostics and installer signal exit statuses are preserved.

Fixes #1481.

Blast radius

Only two files change. bend2/main.ts changes the sole-argument update command. gates/ping.ts adds a failed-download assertion beside the existing successful update check and updates that check's expected command text. Regression coverage stays in the existing installed-CLI gate, following the CLI exit-status precedent in #1214.

The final change uses no temporary files or descriptors. Language/compiler/runtime sources, installer content, permanent caps and gate policy are unchanged.

Regression evidence

Source and rebuilt compiled-CLI probes show the original implementation returns 0 for refused connections, HTTP 404 and truncated responses. The revision returns curl's 7, 22 and 18 respectively, and never executes the failed partial script. Controlled curl failure 23 also propagates. Successful scripts return 0; installer failure 17 and signal status 143 remain observable. Missing curl now reports the shell diagnostic and returns 127.

Checks

• 60 isolated updater executions and eight version controls across the original and revised source/compiled CLIs, including real curl against loopback HTTP, missing tools, signals and scripts larger than 2 MiB.
• Exact failed-download and successful executable-replacement assertions from gates/ping.ts exercised against rebuilt CLIs. They pass on this revision and on current main (d71f42e) with the PR patch applied; the new failure assertion fails on the original implementation.
• Full PR patch applies cleanly to current main; source and compiled updater probes pass on that combined tree.
• Repository gate: 54/54 with CI-pinned ttok 0.3; permanent caps unchanged.
• git diff --check: passed.
• GitHub repo-gate: passed on 8a76db3.

Validation limits

Full gates/ping.ts skipped because the sibling site repository is unavailable. Harmless local installer fixtures do not qualify the real archive/install/hub flow. Local tests ran on macOS arm64 with Bun 1.3.11 and curl 8.7.1; Linux/WSL, Windows, CI Bun 1.4.0 and cluster gates were not run locally.

TypeScript 7.0.2 with bend2/pack/tsconfig.json reports the same 12 diagnostics on the original base and this revision, including existing checker/elaborator/docs errors and missing optional canvas types. Typecheck is not clean; no new diagnostics were introduced.

The shell buffers the complete text installer before execution. Command substitution removes trailing newlines; printf adds one before passing the text to sh.

[Lorenzobattistela]

Thanks @vicmcorrea, the fix is right: refused, 404 and truncated downloads now exit with curl's code, and a partial script no longer runs. The new ping check fails on main and passes here.

It's more code than this needs, though (+140 tokens in main.ts, a temp dir, an fd and two try/finally blocks). It also loses a few things main had: a missing curl now exits 1 with no message, a signalled installer exits 1 instead of 128+n, and Ctrl-C during the install leaves the temp dir behind. Keeping the shell and only running sh once curl has finished (s=$(curl -fsSL ...) && printf '%s\n' "$s" | sh) fixes it in a line, with no temp file. Could you simplify it that way?