[krishhgg]

The README currently sends users through a Homebrew tap. Install directly from this repository's GitHub Releases instead, with a root install.sh that chooses the macOS bundle, checks SHA256SUMS and links the binary under ~/.local without sudo. --service starts it at login through launchd; --uninstall keeps the downloaded models.

Record the installer's owned paths, reject unrelated prefix contents and bin links, keep replacement directories immutable, and serialize install, update and uninstall with locks on the prefix, bin directory and shared LaunchAgent path. Validate the release before creating bin directories, so missing releases and checksum failures can be retried with nested bin paths. Updates switch current atomically and keep the previous install. Service updates persist a pending restart before switching current and recover it on retry. Readiness requires the LaunchAgent PID to own the listening socket and answer /health. Updates read their saved port and cache from the plist; relative cache paths become absolute and printed commands quote shell metacharacters.

Remove the Homebrew formula and tap publishing step. CI installs and uninstalls through the same script, and the README documents that route. The agent prompt and skills follow in the next PR. The release checklist checks the candidate's own PID and free port with a deadline and stops at the first failed command.

Validation:

• 117 installer fixture checks pass under /bin/sh and /bin/dash, including interrupted and failed restarts, foreground listeners, overlapping installs across prefixes and shared paths, failed first installs with nested bin paths, foreign files, service settings and command quoting.
• shellcheck, actionlint and shell syntax checks pass.
• A real LaunchAgent install, interrupted update recovery, ordinary update, rerun and uninstall passed on a nondefault port; cleanup removed the service and install and kept the models.
• The documented candidate check passed; the installed bundle passed 24 smoke requests and 120 questions with zero failures.
• Against GitHub, the installer reports that no release is published and leaves no prefix. Real release asset downloads and the public curl | sh path still need the release candidate.

Confidence Score: 5/5

The PR appears safe to merge; the failed-download retry issue is fixed and no new blocking issue was found.

What we checked:

• Failed downloads allow retries: get_bundle runs before the bin directory is created. Cleanup can therefore remove the empty prefix after a missing release or bad checksum.
• Bin conflicts stop link changes: After taking the bin lock, the installer checks ownership again. A foreign link stops the install before the bundle moves or either link changes.

Summary

This PR replaces Homebrew installation with install.sh, which downloads and checks GitHub Release bundles, manages owned files, and optionally starts a LaunchAgent.

• The latest change fixes retries after failed downloads with a nested bin directory.
• Bin ownership is still checked under a lock before either link changes.
• CI and the release checklist use the installer. No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Lock prefix and shared service path] --> B[Check existing links]
  B --> C[Download and check bundle]
  C --> D[Create registry]
  D --> E[Lock bin directory]
  E --> F[Recheck bin ownership]
  F --> G[Move bundle and switch current]
  G --> H[Restart owned service if needed]
  C -->|Failure| I[Remove staging directory and empty prefix]

Loading

_{Reviews (3) · Last reviewed commit: "Defer bin directories until the release ..."}