[junjuny0227]

Summary

Replace the long Linux curl … | tar --strip-components … line on the site with an install script: curl -fsSL https://junjuny0227.github.io/Repot/install.sh | sh. The script also checks the download's SHA-256, which the old one-liner did not.

Type

• feat
• fix
• refactor / chore
• docs
• ci / build

Changes

• apps/site/public/install.sh (POSIX sh, published by the site as is): picks the archive for this OS/CPU (Linux x86_64, macOS arm64/x86_64; anything else fails with the cargo install alternative), resolves the version from the /releases/latest redirect (no API, no token; REPOT_VERSION pins it), downloads the archive and its .sha256, refuses to install on mismatch, copies only repot into ~/.local/bin (REPOT_INSTALL_DIR) with copy-then-rename, prints the installed version and, if the folder is not on PATH, the line to add for the user's shell. No sudo, no profile edits. Everything runs from main on the last line so a truncated download cannot run half a script.
• scripts/install-sh/install.test.mjs: offline tests against a local stand-in for GitHub Releases (latest redirect, version/dir overrides, checksum mismatch installs nothing, 404 reports the URL). Outside scripts/*.test.mjs because the Windows package-map job runs that glob.
• CI install-script (ubuntu, macos; runs on every change since the script sits under apps/site/): shellcheck, the offline tests, the real latest release piped to sh, and on Linux Debian, Fedora and Arch containers.
• Site: Linux command is the script; the Linux tab explains what it does, keeps Homebrew as the alternative and links the script source (en/ko/ja/zh-Hans).
• READMEs (4) and CLI guides (4): the script as a Homebrew-less option. Spec §14, plan 6, AGENTS command table.

Checks

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace (-p repot-cli --test guide_test only: the guides changed)
• pnpm --filter @repot/desktop typecheck / test / build
• Ran the real flow if behavior changed (--example scan / --example export, or tauri dev)
• Not checked locally, CI only (say which, e.g. Windows/Linux providers, shellcheck)

shellcheck -s sh, node --test scripts/install-sh/*.test.mjs (4; with the checksum comparison removed the mismatch test fails), site typecheck/test (36)/build (dist/install.sh byte-identical to the source), pnpm exec biome ci ., actionlint. Real v0.9.0 install by piping the script to sh: this Mac (aarch64, into a temp REPOT_INSTALL_DIR) and Docker ubuntu:24.04, debian:12, fedora:41, archlinux — each prints repot 0.9.0 and the PATH hint. macOS x86_64 not run (no Rosetta here).

Spec and generated files

• Spec updated in this PR if a product decision changed, or no decision changed
• Generated files regenerated from their source, not edited by hand (scan.json, snapshots/, icons/) (not touched)
• Snapshot diffs read and intended (not touched)

Boundaries

• repot-core does not depend on Tauri and does no network calls (not touched; the script is separate from the CLI, which still never uses the network)
• Commands and file reads go through Env; tests use FakeEnv and fixtures, not real tools (not touched)
• No new crate or npm dependency, or the plan/spec was updated first
• The app still only reads the device; it writes only to the export folder (not touched)