This is a comment left during a code review.
Path: scripts/install.ps1
Line: 224-247

Comment:
**Automatic SSL bypass without user confirmation**

When TLS verification fails, this code automatically retries with `--strict-ssl=false` without asking the user. A TLS verification failure is also exactly what would happen during an active MITM attack — meaning an attacker who intercepts the connection could deliberately trigger this code path, causing the installer to silently download and run a malicious package with SSL disabled.

The warning messages are printed, but the retry happens unconditionally. A user confirmation prompt before the retry would significantly reduce this risk:

```powershell
if ($tlsError) {
    Write-Host "" -Level info
    Write-Host "TLS certificate verification failed during npm install." -Level warn
    Write-Host "This is common on Windows when a corporate proxy or outdated root CA" -Level warn
    Write-Host "intercepts HTTPS traffic." -Level warn
    Write-Host "" -Level info
    Write-Host "NOTE: --strict-ssl=false disables SSL certificate verification and can" -Level warn
    Write-Host "expose you to MITM attacks. Only proceed if you trust your network." -Level warn
    Write-Host "" -Level info

    $response = Read-Host "Retry with --strict-ssl=false? [y/N]"
    if ($response -notmatch '^[Yy]$') {
        Write-Host "Aborted. To fix, update your root CA certificates or set:" -Level info
        Write-Host "  npm config set cafile <path-to-your-ca-bundle.pem>" -Level info
        return $false
    }

    $retryOutput = npm install -g $installSpec --no-fund --no-audit --strict-ssl=false 2>&1
    ...
```

Without a confirmation gate, the TLS-bypass path is effectively a denial-of-security rather than a recovery mechanism.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: scripts/install.ps1
Line: 246-250

Comment:
**Error output joined with spaces, hard to read**

Both error paths join multi-line npm output with a single space, which collapses stack traces and error messages into a single unreadable line. Joining with newlines preserves the original formatting and makes errors much easier to diagnose.

```suggestion
        Write-Host "npm install failed even with --strict-ssl=false:`n$($retryOutput -join "`n")" -Level error
        return $false
    }

    Write-Host "npm install failed:`n$($output -join "`n")" -Level error
```

How can I resolve this? If you propose a fix, please make it concise.