fix: harden self-update security and error handling

[Copilot]

Addresses security vulnerabilities and error handling gaps in the self-update mechanism identified during code review.

Security hardening:

• Use mktemp for temporary files (prevents symlink attacks)
• Download from tagged releases (v${version}) instead of main branch
• Validate version format with regex before accepting remote version
• Verify script readability before attempting backup

Error handling improvements:

• Explicit error checking for backup creation, move, and chmod operations
• Automatic rollback to backup if any operation fails
• Clear error messages at each failure point
• Validates backup timestamp before arithmetic operations

Code quality:

• Properly save/restore IFS variable to prevent side effects
• Robust version extraction supporting multiple quote styles
• Remove conditional backup message (only show if file exists)

Backup management:

• Automatically cleans up backup files older than 1 day (86400 seconds)
• Portable stat command support (Linux and BSD)
• Safe timestamp validation prevents arithmetic errors
• Cleanup actions logged for audit trail

Example of the improved error handling:

if ! mv "${temp_file}" "${SCRIPT_PATH}"; then
    print_error "Failed to install update (move operation failed)"
    if [[ "${had_backup}" == true ]]; then
        mv "${SCRIPT_PATH}.backup" "${SCRIPT_PATH}"
        print_info "Restored previous version from backup."
    fi
    return 1
fi

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[prettyleaf]

needs a check to delete old backup files. if backup is older than 1 day = delete

[Copilot]

needs a check to delete old backup files. if backup is older than 1 day = delete

Added automatic cleanup of backup files older than 1 day in commit 796ac4c. The cleanup runs at the start of self_update() and:

• Checks if a backup file exists
• Calculates its age using stat (supports both Linux and BSD)
• Deletes it if older than 86400 seconds (24 * 60 * 60)
• Logs the cleanup action to the audit log

[prettyleaf]

@copilot close #1