Add an "Environment variable options" subsection to the Command Lines
section covering the new user-facing runtime toggles and the CLI
"Start Fresh" confirmation requirement, with copy-paste examples.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Security hardening, all backward-compatible (opt-in via NSL_* env vars):
- Downloads: add nsl_download() and route the launcher-installer and EA
downloads through it. Refuses non-HTTPS URLs and supports optional
SHA-256 verification (removes the file on mismatch so a tampered or
partial download is never run).
- Deletes: add nsl_safe_rm() (allowlisted paths, refuses empty / "/" /
$HOME) and route the download-dir and scanner/service/env_vars deletes
through it. Replace Start Fresh's unbounded delete_path with an
allowlisted version so a bad variable expansion can't wipe unrelated
data.
- Debug tracing: gate 'set -x' behind NSL_DEBUG (default off) so the log
no longer echoes every expanded value (paths, tokens) by default.
- Dry run: NSL_DRY_RUN=1 previews destructive actions (deletes, Start
Fresh) without performing them.
- Start Fresh: require NSL_CONFIRM_START_FRESH=1 for the non-interactive
(CLI) path so an accidental/automated arg can't silently wipe.
- Decky installer: use sudo's own credential handling (sudo -v / sudo)
instead of capturing the password via zenity and piping it to 'sudo -S'
(which exposes it via argv/process listings).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Aaron