From 1dffdcf2ed906cd758d25cb6ce4cf8ed0c7a9371 Mon Sep 17 00:00:00 2001
From: Alex Hope-O'Connor <alex.hope.oconnor@pomonaqld.au>
Date: Thu, 5 Feb 2026 23:28:10 +1000
Subject: [PATCH] install.sh: strip control chars from GitHub API JSON so jq
 parses release body

GitHub can return release body with unescaped control characters (e.g. from
generated release notes); jq rejects them. Sanitize response in fetch_release
and list_releases before piping to jq (keep \n and \r).
---
 scripts/install.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/install.sh b/scripts/install.sh
index 7bc8ad6..332a873 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -238,9 +238,12 @@ fetch_release() {
   body="$(echo "$resp" | sed '$d')"
   if [ "$code" != "200" ]; then
     echo "Error: GitHub API returned $code for $api_url" >&2
+    body="$(printf '%s' "$body" | tr -d '\000-\011\013\014\016-\037')"
     echo "$body" | jq -r '.message // .' 2>/dev/null || echo "$body" >&2
     exit 1
   fi
+  # GitHub API can return release body with unescaped control chars; jq rejects them. Strip control chars (keep \n \r).
+  body="$(printf '%s' "$body" | tr -d '\000-\011\013\014\016-\037')"
   echo "$body"
 }
 
@@ -256,6 +259,7 @@ list_releases() {
     echo "Error: GitHub API returned $code" >&2
     exit 1
   fi
+  body="$(printf '%s' "$body" | tr -d '\000-\011\013\014\016-\037')"
   echo "$body" | jq -r '.[] | "\(.tag_name)  \(.name)  \(.published_at // .created_at)"'
   exit 0
 }