feat: convert the powershell tool to a typescript installer

[viceice]

Changes

Converts powershell from a v2 shell script to a TypeScript installer. The prepare step installs the distro specific apt dependencies for jammy, noble and resolute, and the download is now verified against the release's hashes.sha256.

Context

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Code and tests were written by Claude Opus 5.5 in Claude Code.

Use of AI in replying to PR comments

Who answers review comments:

• @username will read and reply directly. Name the account.
• An agent will draft replies and @viceice will read them before they are posted.
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified tests

🤖 Generated with Claude Code

Summary by CodeRabbit

• Improvements
  • PowerShell setup now verifies downloaded release archives against published SHA-256 checksums and reports errors when checksums are missing or don’t match.
  • PowerShell installation supports both x64 and ARM64 systems, with package preparation for supported Ubuntu releases.
  • Installation now creates a pwsh command wrapper and checks that PowerShell runs successfully.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 0c409605-df95-4dad-bed6-76c3ba654d64

📥 Commits

Reviewing files that changed from the base of the PR and between f1b78e2 and 3003a00.

📒 Files selected for processing (3)

• src/cli/tools/dotnet/powershell.spec.ts
• src/cli/tools/dotnet/powershell.ts
• src/usr/local/containerbase/tools/v2/powershell.sh

💤 Files with no reviewable changes (1)

• src/usr/local/containerbase/tools/v2/powershell.sh

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

PowerShell preparation and installation now use CLI services instead of the legacy shell tool. The services select dependencies by Ubuntu release, install and verify architecture-specific archives, link pwsh, and test its version. Vitest coverage checks supported releases, installation outcomes, and linking.

Changes

PowerShell setup

Layer / File(s)	Summary
Prepare PowerShell dependencies src/cli/tools/dotnet/powershell.ts, src/cli/tools/dotnet/powershell.spec.ts, src/usr/local/containerbase/tools/v2/powershell.sh	The prepare service selects dependencies by Ubuntu release and rejects unsupported releases. Tests cover Jammy, Noble, Resolute, and Focal. The legacy shell tool is removed.
Install, link, and test PowerShell src/cli/tools/dotnet/powershell.ts, src/cli/tools/dotnet/powershell.spec.ts	The install service selects an architecture-specific archive, checks its SHA-256 checksum, extracts it, and sets pwsh permissions. It also links the shell wrapper and runs pwsh -version. Tests cover successful installation, checksum failures, linking, and version testing.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 3003a

No specific merge-blocking issue is established for the PowerShell migration; complete the normal checks before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3003a

The migration changes an installation boundary, but the reviewed flow does not show a clear expansion of caller control or a weakened archive check. Some legacy behavior and interruption scenarios remain uncertain.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected authority is the environment running the PowerShell installer: preparation can change system packages, while installation writes a versioned tool and exposes pwsh through a wrapper. The reviewed service does not take caller-supplied package names or a caller-supplied download host.

Trust Boundaries and Controls

• observed — Preparation requires root. The inherited install service does not itself require root; the shared downloader checks the archive against the supplied SHA-256 on both cache reuse and fresh download.

Resilience and Maintainability Implications

• observed — AptService removes its configured proxy file after an attempted package update or install, including when those commands fail.

Hardening Proposals

• proposed — If the intended integrity guarantee must withstand compromise of the release download route, authenticate the checksum manifest through an independent trusted signature or pinned digest.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: converting the PowerShell tool from a v2 shell script to a TypeScript installer.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

CI failed: 1 infrastructure timeout during container build and 1 test-success failure in the build pipeline.

Overview

Analysis of the CI logs revealed two distinct failures: a timeout during docker buildx bake (infrastructure issue) and a failure in the test-success check (change-related test failure).

Failures

Docker Build Timeout (confidence: high)

• Type: infrastructure
• Affected jobs: 108018040752
• Related to change: no
• Root cause: The docker buildx bake command for test-distro hit the 10-minute timeout during apt package acquisition and installation.
• Suggested fix: Rerun the workflow or check network/proxy performance during container builds.

Test Success Failure (confidence: medium)

• Type: test
• Affected jobs: 108028159079
• Related to change: yes
• Root cause: The build / test-success job exited with code 1, indicating a test or status check failure.
• Suggested fix: Run the test suite locally to identify and resolve any failing tests.

Summary

• Change-related failures: 1 test failure (build / test-success job failed with exit code 1)
• Infrastructure/flaky failures: 1 infrastructure timeout during container build
• Recommended action: Review the test suite locally to find the failing tests, and rerun the workflow to clear the infrastructure timeout.

Code Review ✅ Approved

🟡 Medium risk · PowerShell installation now uses distro-specific dependencies and checksum-verified release archives.

Converts the PowerShell tool from a v2 shell script to a TypeScript installer with distro-specific apt dependency installation for jammy, noble, and resolute, plus SHA256 hash verification. Comprehensive unit tests added. No issues found.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}