What Problem This Solves

Fixes an issue where users running either shell installer could wait indefinitely when a curl download connected successfully but then stopped transferring data.

Why This Change Was Made

Both shell installers now abort curl transfers that remain below 1 byte/s for 30 seconds. The change is intentionally limited to post-connect transfer stalls: it does not impose a fixed wall-clock cap or change DNS, TCP, or TLS connection tolerance.

User Impact

Installer downloads now fail and surface curl's timeout status instead of hanging forever after a server stops sending data; slow downloads that continue making progress remain supported.

Evidence

• Added shell-level coverage for both install.sh and install-cli.sh that captures the curl invocation, verifies --speed-limit 1 --speed-time 30, simulates curl exit 28, and verifies that status is propagated.
• Controlled real-curl proof used a local HTTP server and the production 1 byte/s threshold with a 2-second observation window (scaled down from 30 seconds):
  • A response that sent headers and then no body exited 28 with Operation too slow. Less than 1 bytes/sec transferred the last 2 seconds.
  • A deliberately slow response that sent 1 byte every 500 ms completed successfully in 4.02 seconds.
• Exact-head fork CI run 29473899108 passed at 3203ef19f37cdf71047a3547eace3f1e09ca869a with 77 passing and no failed or pending checks.
• Focused checks-node-compact-small-5 job ran test/scripts/install-sh.test.ts: 81 tests passed in 2367 ms.
• Focused checks-node-compact-small-4 job ran test/scripts/install-cli.test.ts: 31 tests passed in 782 ms.
• Exact-head Website Installer Sync run 29473899114 passed its static, Linux Docker, macOS installer, and Windows installer jobs.
• bash -n scripts/install.sh scripts/install-cli.sh passes.
• git diff --check upstream/main...HEAD passes.
• Fresh full-branch Claude autoreview against upstream/main@9f5609382b5464c9df2a6c81b1ee12d650367730 reports the patch correct with no accepted or actionable findings (confidence 0.88).
• Per repository policy, contributor repository code was not executed locally; exact-head repository proof comes from fork CI. The controlled curl probe exercised the documented command-line contract against a standalone local server without executing repository code.
• curl's documented contract states that --speed-limit and --speed-time abort a transfer that remains below the configured rate for the configured period.