fix(install): resolve latest tag from the releases/latest redirect, not API JSON - #33

Problem

A user's install failed every time with:

==> Downloading Zee-https://api.github.com/repos/sumerc/zee/releases/361182589.dmg...
error: download failed: https://github.com/sumerc/zee/releases/download/https://api.github.com/...

361182589 is v0.4.0's release id. Version resolution parsed the releases/latest API JSON with awk -F'"' '/"tag_name"/ {print 4ドル; exit}', which silently assumes GitHub's pretty-printed one-field-per-line layout. The user's machine (TLS-inspecting security software) re-served the same JSON minified onto one line — awk then matched the whole object and 4ドル was the value of its first quoted field, "url". The resulting garbage VERSION 404s deterministically, so re-running never helps.

Reproduced locally by piping the API response through jq -c: output matches the user's report byte-for-byte.

Fix

Resolve the tag from the https://github.com/<repo>/releases/latest redirect instead:

VERSION="$(curl -fsS -o /dev/null -w '%{redirect_url}' "https://github.com/${REPO}/releases/latest")"
VERSION="${VERSION##*/}"

• No JSON, so no shape to mangle — a Location header survives any middlebox.
• Drops the api.github.com dependency, which also removes its 60 req/hour unauthenticated rate limit (the old error message had to apologize for exactly that).
• Guard tightened from non-empty to v* so a future resolution failure errors at the source instead of producing a nonsense URL.

Not affected: update/check.go uses encoding/json (whitespace-immune). Audited every other download — model manifest.txt and checksums.txt are line-oriented by design; ggufs/DMG/update-zip are SHA256-gated. The awk was the only shape-dependent parse.

Testing

• Fixed script run end-to-end locally: resolves v0.4.0 from the redirect, downloads the DMG, checksum verifies, installs.
• bash -n clean.
• Design-notes entry added recording the incident and the rejected alternative (shape-tolerant JSON grep).

🤖 Generated with Claude Code