Skip to content

feat: curl installer at crawlproof.com/install.sh - #354

Merged
ralyodio merged 1 commit into
masterfrom
feat/curl-install
Oct 13, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/curl-install

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds curl -fsSL https://crawlproof.com/install.sh | sh, per the standing rule that every product serves /install.sh for its CLI.

  • public/install.sh installs the scoped @profullstack/crawlproof@latest globally. The unscoped crawlproof on npm is not ours. It uses bun if present, otherwise npm with Node >= 22.6 (the package's engines floor). When the npm prefix is not writable it installs into ~/.local instead of sudo, then checks crawlproof is on PATH. Re-running it upgrades.
  • proxy.ts: install.sh is added to the matcher's exclusions next to llms.txt and skill.md, so the crawl gateway and the Supabase session refresh never run on it. Next serves it from public/ as application/x-sh.
  • The line is in the README, packages/cli/README.md and /docs/cli, and llms.txt has a new CLI section.
  • tests/install-sh.test.ts pins the scoped package and the matcher exclusion.

Tested: sh -n passes. I ran it in throwaway HOMEs on both paths (bun, and npm-only with an unwritable prefix that falls back to ~/.local), and crawlproof --version printed 0.5.0 on each.

🤖 Generated with Claude Code

… CLI

curl -fsSL https://crawlproof.com/install.sh | sh installs the scoped
@profullstack/crawlproof (the unscoped `crawlproof` on npm is not ours):
bun if present, else npm with Node >= 22.6, falling back to ~/.local
instead of sudo, then checks the bin is on PATH. Re-running it upgrades.

public/install.sh is excluded from the proxy matcher, as llms.txt is, so
the crawl gateway and the session refresh never run on it. The line is in
the README, the CLI README, /docs/cli and a new CLI section in llms.txt.
tests/install-sh.test.ts pins the scoped package and the matcher exclusion.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

48 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 31 | LOW: 15

Severity Rule Location
HIGH tls-verification-disabled lib/onion.ts:48
HIGH secret-generic-credential lib/sp/platforms/facebook.ts:32
MEDIUM js-unescaped-html-sink app/(app)/dashboard/admin/email-broadcast/EmailBroadcastForm.tsx:125
MEDIUM js-unescaped-html-sink app/(app)/dashboard/projects/[id]/autoblog/articles/[articleId]/page.tsx:214
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:67
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:97
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:104
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:110
MEDIUM js-unescaped-html-sink app/(marketing)/recent/page.tsx:186
MEDIUM js-unescaped-html-sink app/(marketing)/recent/page.tsx:190
MEDIUM js-unescaped-html-sink app/c/[project]/[slug]/page.tsx:77
MEDIUM js-unescaped-html-sink app/c/[project]/page.tsx:57
MEDIUM js-unescaped-html-sink app/careers.js/route.ts:228
MEDIUM js-unescaped-html-sink app/careers.js/route.ts:285
MEDIUM js-unescaped-html-sink app/layout.tsx:128
MEDIUM js-open-redirect app/login/form.tsx:39
MEDIUM js-unescaped-html-sink app/r/[token]/page.tsx:176
MEDIUM js-open-redirect app/signup/form.tsx:43
MEDIUM js-open-redirect components/billing/buy-credits-modal.tsx:98
MEDIUM js-unescaped-html-sink components/json-ld.tsx:8
MEDIUM js-unescaped-html-sink components/report/markdown-view.tsx:15
MEDIUM js-unescaped-html-sink lib/careers/page-templates.ts:198
MEDIUM js-dynamic-code-execution lib/crawl-limits.ts:67
MEDIUM redos-nested-quantifier lib/emailMarkdown.ts:41
MEDIUM redos-nested-quantifier lib/emailMarkdown.ts:324
MEDIUM redos-nested-quantifier lib/lx/articleGen.ts:100
MEDIUM redos-nested-quantifier lib/tracker/agent-gate.ts:61
MEDIUM sh-predictable-temp-path ops/selfhost/server/setup-supabase.sh:218
MEDIUM sql-template-interpolation scripts/detect-slot-themes.ts:31
MEDIUM sql-template-interpolation scripts/purge-constructed-keywords.ts:163
MEDIUM sql-template-interpolation scripts/purge-offniche-keywords.ts:124
MEDIUM js-dynamic-code-execution scripts/test-crawl-limits.mjs:14
MEDIUM js-dynamic-code-execution scripts/test-crawl-limits.mjs:24
LOW secret-generic-credential app/(marketing)/docs/autoblog-webhook/page.tsx:150
LOW secret-generic-credential lib/sp/platforms/linkedin.ts:25
LOW js-dynamic-code-execution tests/careers-page-templates.test.ts:21
LOW js-dynamic-code-execution tests/careers-widget-script.test.ts:19
LOW js-dynamic-code-execution tests/careers-widget-script.test.ts:69
LOW js-dynamic-code-execution tests/contract/ad-visitor-id.test.ts:51
LOW js-dynamic-code-execution tests/contract/ad-visitor-id.test.ts:52
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:20
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:24
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:25
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:26
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:31
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:35
LOW secret-generic-credential tests/contract/posthog-integration.test.ts:13
LOW secret-generic-credential tests/lead-campaign.test.ts:16

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit e6e3ee6 into master Oct 13, 2026
10 checks passed
@ralyodio
ralyodio deleted the feat/curl-install branch October 13, 2026 00:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant