fix(installer): install the CLI on macOS and Windows

[ralyodio]

The install script at https://threatcrush.com/install.sh fails outright on macOS, leaving the machine with no threatcrush at all:

ERR_PNPM_FETCH_404  GET https://registry.npmjs.org/@profullstack%2Fthreatcrush-desktop: Not Found
@profullstack/threatcrush-desktop is not in the npm registry

Cause

detect_os returns Darwin on macOS, which sets PLATFORM_KIND=desktop-client. That took a branch which skipped install_global_package "$PKG_NAME" entirely and instead ran pnpm add -g @profullstack/threatcrush-desktop.

That package has never been published to npm. apps/desktop is an Electron app shipped to GitHub Releases as .dmg / .exe / .AppImage / .deb (see desktop-release.yml, and the assets on v0.11.4). Under set -e the 404 aborted the whole script.

Windows hits the same branch. Linux desktop was less bad — it installed the CLI first, then aborted on the same 404.

Fix

• Always install_global_package "$PKG_NAME", on every platform. The CLI is a plain Node package and runs fine on macOS.
• Replace install_desktop_bundle (npm) with announce_desktop_bundle, which prints the matching GitHub Releases asset for the detected OS/arch. Never fatal.
• Add detect_arch so the pointer is right on Apple Silicon vs Intel.
• Same fix in threatcrush update, which pushed the same nonexistent package onto its command list. remove is untouched — it already guards on packageLooksInstalled.

Verification

• sh -n clean; simulated runs with stubbed uname/pnpm for Darwin/arm64 and Linux/x86_64 — both install the CLI and exit 0; the macOS run correctly names threatcrush-desktop-<version>-arm64.dmg.
• install-script.test.ts updated and passing (6/6). It now asserts the script contains no reference to the unpublished package.
• Pre-commit passed: CLI build + next build including TypeScript.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TuQfdnSCZAC5bDTCgTwSVW

[github-actions]

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:96
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:100
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	PRD.md:268
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:47
LOW	secret-aws-access-key	scripts/smoke-test.sh:112

Snippets are redacted; ThreatCrush never prints matched credential material.