Harden installer and temporary storage paths

changelog.d/unreleased/3378.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3378
+affected:
+  - src/CodeIndex/Cli/ProgramRunner.cs
+  - tests/CodeIndex.Tests/ProgramRunnerTests.cs
+---
+
+## English
+
+- **Upgrade installer launches bash through a trusted absolute path (#3378)** — `cdidx upgrade` now resolves the POSIX installer shell from known absolute paths instead of relying on the ambient `PATH`.
+
+## 日本語
+
+- **upgrade installer が信頼済みの絶対パスから bash を起動するようになりました (#3378)** — `cdidx upgrade` は周囲の `PATH` に頼らず、既知の絶対パスから POSIX installer shell を解決します。

changelog.d/unreleased/3411.fixed.md

@@ -0,0 +1,23 @@
+---
+category: fixed
+issues:
+  - 3411
+affected:
+  - src/CodeIndex/Cli/DataDirectorySecurity.cs
+  - src/CodeIndex/Cli/ExportImportCommandRunner.cs
+  - src/CodeIndex/Cli/GlobalToolLog.cs
+  - src/CodeIndex/Cli/ProgramRunner.cs
+  - src/CodeIndex/Cli/UpdateChecker.cs
+  - tests/CodeIndex.Tests/DataDirectorySecurityTests.cs
+  - tests/CodeIndex.Tests/ExportImportCommandRunnerTests.cs
+  - tests/CodeIndex.Tests/GlobalToolLogTests.cs
+  - tests/CodeIndex.Tests/ProgramRunnerTests.cs
+---
+
+## English
+
+- **Sensitive temporary and cache files now use private directories (#3411)** — upgrade installer scripts, export snapshots, update-check cache writes, and persistent log directories now create owner-only storage before writing sensitive material.
+
+## 日本語
+
+- **機微な一時ファイルとキャッシュファイルが private directory を使うようになりました (#3411)** — upgrade installer script、export snapshot、update-check cache、persistent log directory は、機微な内容を書き込む前に所有者限定の保存先を作成します。

changelog.d/unreleased/3499.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3499
+affected:
+  - install.sh
+  - tests/CodeIndex.Tests/InstallScriptTests.cs
+---
+
+## English
+
+- **`install.sh --purge-cache` now validates cache roots before deletion (#3499)** — uninstall cache purges now reject unsafe, relative, empty, or root cache locations before recursively removing the cdidx cache directory.
+
+## 日本語
+
+- **`install.sh --purge-cache` が削除前に cache root を検証するようになりました (#3499)** — uninstall 時の cache purge は、cdidx cache directory を再帰削除する前に、危険な値・相対パス・空・root の cache location を拒否します。

changelog.d/unreleased/3503.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3503
+affected:
+  - install.sh
+  - tests/CodeIndex.Tests/InstallScriptTests.cs
+---
+
+## English
+
+- **Rollback cleanup now validates promoted asset names before deletion (#3503)** — installer rollback removal rejects unsafe or unexpected asset names before deleting any promoted files.
+
+## 日本語
+
+- **Rollback cleanup が削除前に promoted asset name を検証するようになりました (#3503)** — installer の rollback removal は、promoted file を削除する前に危険または想定外の asset name を拒否します。

changelog.d/unreleased/3511.security.md

@@ -0,0 +1,16 @@
+---
+category: security
+issues:
+  - 3511
+affected:
+  - install.sh
+  - tests/CodeIndex.Tests/InstallScriptTests.cs
+---
+
+## English
+
+- **Normal install and uninstall now reject risky install directories (#3511)** — `install.sh` validates `CDIDX_INSTALL_DIR` before locking, installing, or removing files, and requires `CDIDX_ALLOW_RISKY_INSTALL_DIR=1` for root, home, or system install targets.
+
+## 日本語
+
+- **通常 install / uninstall が危険な install directory を拒否するようになりました (#3511)** — `install.sh` は lock・install・file removal の前に `CDIDX_INSTALL_DIR` を検証し、root・home・system install target には `CDIDX_ALLOW_RISKY_INSTALL_DIR=1` を要求します。