🔒 Secure remote update mechanism using reqwest and tempfile

[undivisible]

🎯 What: The cmd_update_remote function in in-cli/src/main/update.rs previously used curl piped directly into bash to execute a remote install script. This was replaced with a native Rust implementation using reqwest and tempfile.

⚠️ Risk: Running a bash script piped directly from curl -fsSL inside a shell execution is vulnerable to network tampering, improper environment handling, or execution of arbitrary payloads (e.g. executing 404 pages if the URL was missing).

🛡️ Solution: The update mechanism now uses reqwest::blocking::get to fetch the script over HTTPS with strict TLS validation and HTTP success code checking. The response is written securely to a local temporary file using tempfile::NamedTempFile, which is then explicitly executed by bash as a file, completely removing the inline string execution and curl dependency.

---

PR created automatically by Jules for task 6734880655533966610 started by @undivisible

---

Note

Medium Risk
Changes how remote install scripts are fetched and executed (TLS and HTTP handling), though behavior is still “download and run install.sh” on Unix when local update is unavailable.

Overview
When there is no local inauguration checkout, in update no longer shells out to curl -fsSL … | bash. It now downloads install.sh with reqwest (blocking HTTPS), rejects non-success HTTP responses, writes the body to a tempfile::NamedTempFile, and runs bash on that path only.

reqwest and tempfile are added to in-cli/Cargo.toml; Cargo.lock picks up the HTTP/TLS stack (e.g. rustls, hyper) as transitive deps.

^{Reviewed by Cursor Bugbot for commit 6f0a9b8. Configure here.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_001ba574-e24e-4c85-91d7-fb3bc31b8558)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_79affc9f-6c77-48cd-bfad-095b8bab60aa)