From d7d492828f59286e14779b7c0ee868a94b1f738f Mon Sep 17 00:00:00 2001
From: aniongithub <ani@anionline.me>
Date: Sun, 2 Aug 2026 11:19:07 -0700
Subject: [PATCH] Stop silently installing the devcontainer CLI from the npm
 registry

install.sh auto-installed @devcontainers/cli by piping the devcontainers/cli
standalone installer to sh with all output suppressed. That fetches from
registry.npmjs.org, which corporate egress policies (e.g. Microsoft Defender's
NPM URL block) intercept -- and because it ran silently, the network activity
and the resulting failure were invisible.

Make the devcontainer CLI detect-only, consistent with how devpod and gh are
already handled: report whether it is present and, if not, print the install
URL (plus a 'brew install devcontainer' alternative that avoids the npm
registry). Nothing is downloaded on the user's behalf.

install.ps1 needs no change -- it only detects devcontainer in WSL and
delegates the binary install to install.sh, so the silent fetch is gone from
the Windows/WSL path too.

Copilot-Session: 1061ab5c-0b78-4baa-87e2-2ba93359413f
---
 install.sh | 37 ++++++++-----------------------------
 1 file changed, 8 insertions(+), 29 deletions(-)

diff --git a/install.sh b/install.sh
index 9cacab3..7ecd562 100755
--- a/install.sh
+++ b/install.sh
@@ -3,12 +3,9 @@ set -euo pipefail
 
 # devcontainer-mcp installer
 # Downloads the latest release binary.
-# Backend CLIs:
-#   - devcontainer (@devcontainers/cli) is auto-installed via the official
-#     standalone installer (bundles its own Node.js runtime) into
-#     ~/.local/share/devcontainer-mcp/devcontainers/ when missing.
-#   - devpod and gh are detected only; if missing, the MCP server returns
-#     a helpful error message and the installer prints install URLs.
+# Backend CLIs (devcontainer, devpod, gh) are detected only; if missing,
+# the MCP server returns a helpful error message and the installer prints
+# install URLs. Nothing is downloaded silently on your behalf.
 #
 # Usage:
 #   curl -fsSL https://raw.githubusercontent.com/aniongithub/devcontainer-mcp/main/install.sh | bash
@@ -307,32 +304,14 @@ echo ""
 echo "Backend CLIs detected (install as needed — MCP server gives helpful errors if missing):"
 command -v devpod       >/dev/null 2>&1 && echo "  ✓ devpod"       || echo "  ✗ devpod        — https://devpod.sh/docs/getting-started/install"
 
-# devcontainer CLI: auto-install via the official standalone installer
-# (bundles its own Node.js runtime — no system Node required) into a
-# folder we own, then symlink the binary into INSTALL_DIR so it picks
-# up the same PATH guidance the script gives for the main binary.
-install_devcontainer_cli() {
-  local cli_prefix="${HOME}/.local/share/devcontainer-mcp/devcontainers"
-  local installer_url="https://raw.githubusercontent.com/devcontainers/cli/main/scripts/install.sh"
-  echo "  … devcontainer CLI not found — installing standalone bundle into ${cli_prefix}"
-  mkdir -p "$(dirname "$cli_prefix")"
-  if ! curl -fsSL "$installer_url" | sh -s -- --prefix "$cli_prefix" >/dev/null 2>&1; then
-    echo "  ✗ devcontainer   — standalone install failed; see https://github.com/devcontainers/cli#install-script"
-    return 1
-  fi
-  local shim="${cli_prefix}/bin/devcontainer"
-  if [ ! -x "$shim" ]; then
-    echo "  ✗ devcontainer   — install completed but ${shim} is missing"
-    return 1
-  fi
-  ln -sf "$shim" "${INSTALL_DIR}/devcontainer"
-  echo "  ✓ devcontainer (auto-installed → ${INSTALL_DIR}/devcontainer)"
-}
-
+# devcontainer CLI: detect only. Installing @devcontainers/cli fetches from
+# the npm registry (registry.npmjs.org), which some corporate egress
+# policies block, so the installer never downloads it silently — it just
+# reports whether it is present, like the other backends.
 if command -v devcontainer >/dev/null 2>&1; then
   echo "  ✓ devcontainer"
 else
-  install_devcontainer_cli || true
+  echo "  ✗ devcontainer   — https://github.com/devcontainers/cli#install-script (or 'brew install devcontainer')"
 fi
 
 command -v gh           >/dev/null 2>&1 && echo "  ✓ gh (codespaces)" || echo "  ✗ gh (codespaces) — https://cli.github.com/"