fix(cli): restrict the maintained update fetch to HTTPS

src/lib/actions/update.test.ts

@@ -201,6 +201,29 @@ describe("runUpdateAction", () => {
     expect(log).toHaveBeenCalledWith(expect.stringContaining("reinstalling anyway (--fresh)"));
   });
 
+  it("runs the maintained installer fetch with HTTPS pinned across redirects", async () => {
+    const spawnSyncImpl = vi.fn(
+      () => ({ status: 0, stdout: "", stderr: "", signal: null }) as never,
+    );
+
+    const result = await runUpdateAction(
+      { yes: true },
+      {
+        currentVersion: () => "0.1.0",
+        getMaintainedTarget: () => maintainedTarget("0.2.0"),
+        isSourceCheckout: () => false,
+        log: vi.fn(),
+        spawnSyncImpl,
+      },
+    );
+
+    expect(result.ranInstaller).toBe(true);
+    const [command, args] = spawnSyncImpl.mock.calls[0] as unknown as [string, readonly string[]];
+    expect(command).toBe("bash");
+    expect(args.at(-1)).toContain("--proto '=https'");
+    expect(args.at(-1)).toContain("--proto-redir '=https'");
+  });
+
   it("refuses --fresh when the maintained tag is older than the install, even with --yes (#8306)", async () => {
     const spawnSyncImpl = vi.fn();
     const error = vi.fn();

src/lib/actions/update.ts

@@ -11,7 +11,14 @@ import { normalizeVersion } from "../domain/installer/version";
 
 export const NEMOCLAW_INSTALLER_URL = "https://www.nvidia.com/nemoclaw.sh";
 export const NEMOCLAW_REPO_URL = "https://github.com/NVIDIA/NemoClaw.git";
-export const NEMOCLAW_UPDATE_COMMAND = `curl -fsSL ${NEMOCLAW_INSTALLER_URL} | bash`;
+/**
+ * Pipeline `nemoclaw update` runs to install the maintained build.
+ * `--proto '=https'` and `--proto-redir '=https'` hold the transfer on HTTPS for
+ * the initial request and for every redirect, so a downgrade redirect fails
+ * closed instead of piping plaintext-fetched bytes into `bash`. Same fetch
+ * hardening as `src/lib/onboard/install-ollama-linux.ts`.
+ */
+export const NEMOCLAW_UPDATE_COMMAND = `curl -fsSL --proto '=https' --proto-redir '=https' ${NEMOCLAW_INSTALLER_URL} | bash`;
 export const NEMOCLAW_MAINTAINED_INSTALL_TAG = "lkg";
 
 type LogFn = (message?: string) => void;
@@ -100,7 +107,7 @@ function updateBranding(env: NodeJS.ProcessEnv): UpdateBranding {
   return {
     cliName: "nemoclaw",
     displayName: "NemoClaw",
-    maintainedUpdateCommand: NEMOCLAW_UPDATE_COMMAND,
+    maintainedUpdateCommand: `curl -fsSL ${NEMOCLAW_INSTALLER_URL} | bash`,
   };
 }