install: curl-installer for the release binary (#64)

README.md

@@ -86,6 +86,14 @@ if the Proxy is down. Software that ignores proxy variables can use
 connection profile yet. Obtain enrollment, member-set inputs, the Elder onion,
 and its signer pin from the operator you intend to use.
 
+Prefer the prebuilt Rust client binary? One line installs it into
+`~/.local/bin` after verifying its published checksum; options and caveats are
+in [`rust/INSTALL.md`](rust/INSTALL.md):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/dmarzzz/shade-tree-node/main/scripts/install.sh | sh
+```
+
 ## How it works
 
 ![Shade Tree reputation gate and network path](docs/post/fig/shade-tree-readme.svg)

docs/CONFIG.md

@@ -182,6 +182,10 @@ Read only by the one-command droplet bring-up (not by any `shade-tree` process).
 | `SHADE_TREE_REGISTRAR` | `0` | `1` = render + start `shade-tree-registrar.service` (the 402 registrar), publish it as an extra `HiddenServicePort SHADE_TREE_REGISTRAR_PORT` of an onion this box runs — the BOOTNODE onion (bootnode+gateway box; the bootnode advertises it in `/health`) or, T-FEAT-9, the GATEWAY onion (gateway-only box, `SHADE_TREE_BOOTNODE_ONION` set) — and make the heartbeat advertise it as signed `caps.pay`. Companions (all required with `1`): `SHADE_TREE_PAID_ACCESS_CONTRACT`, `SHADE_TREE_PAY_ASSET`, `SHADE_TREE_PAY_PRICES`, `SHADE_TREE_RPC_URL`, `paid` in `SHADE_TREE_ADMIT`; optional `SHADE_TREE_PAY_PROTOCOLS` (default `x402,mpp`; rendered into the registrar unit + both adverts), `SHADE_TREE_PAY_TO`, `SHADE_TREE_REGISTRAR_PORT`, `SHADE_TREE_PAY_CHAIN_ID`. The operator key is a secret → a 0600 drop-in, never a tunable (`docs/OPERATOR.md` "Selling access via 402"). |
 | `SHADE_TREE_RENDER_ONLY` | (unset) | `<dir>`: render the torrc + units under `<dir>/etc/…` and exit (no root, nothing installed); `--render <dir>` is the same. |
 
+## Installer (`scripts/install.sh`)
+
+Read only by the one-line installer for the prebuilt Rust client, not by any `shade-tree` process: `SHADE_TREE_VERSION`, `SHADE_TREE_LIVE`, `SHADE_TREE_INSTALL_DIR`, `SHADE_TREE_FORCE`, `SHADE_TREE_TARGET`, `SHADE_TREE_LIBC`, `SHADE_TREE_RELEASE_BASE`. Defaults and meaning: `rust/INSTALL.md` "One-line install".
+
 ## Demo / test only
 
 Not part of the core protocol; set only when running the demo page or the Sepolia integration script.

rust/INSTALL.md

@@ -5,12 +5,54 @@ Tagged releases publish two variants of the `shade-tree` binary:
 | Variant | Includes | Published targets |
 | --- | --- | --- |
 | default | directory and receipt verification, selection, cache | Linux x86_64/aarch64 (GNU and musl), macOS x86_64/aarch64, Windows x86_64 |
-| `-live` | default features plus RLN proving and embedded Tor | Linux x86_64, macOS aarch64, Windows x86_64 |
+| `-live` | default features plus RLN proving and embedded Tor | Linux x86_64 (GNU), macOS aarch64, Windows x86_64 |
 
 Every asset has a matching `.sha256` file. The `-live` builds embed the
 repository's testnet RLN artifacts; review
 [`../circuits/rln/ARTIFACTS.md`](../circuits/rln/ARTIFACTS.md) before use.
 
+## One-line install
+
+`scripts/install.sh` detects your OS and CPU, downloads the matching asset and
+its `.sha256` from the latest release, verifies the checksum, and only then
+places the binary in `~/.local/bin/shade-tree`. It needs `curl` and
+`sha256sum`, `shasum`, or `openssl`. It never uses sudo and never runs a byte
+it has not verified. It is configured through environment variables, so it
+behaves the same whether piped or saved and read first.
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/dmarzzz/shade-tree-node/main/scripts/install.sh | sh
+```
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `SHADE_TREE_VERSION` | latest release | Pin a tag, `v0.3.0` or `0.3.0` |
+| `SHADE_TREE_LIVE` | `0` | `1` installs the `-live` variant where the table above lists one; other targets are refused. Only `0` or `1` is accepted |
+| `SHADE_TREE_INSTALL_DIR` | `$HOME/.local/bin` | Destination directory, created if missing |
+| `SHADE_TREE_FORCE` | `0` | `1` replaces a symlink at the destination, which is how npm installs its own `shade-tree`. A regular file there is replaced without it, with a note |
+| `SHADE_TREE_TARGET` | detected | Skip detection, for example `x86_64-unknown-linux-musl` |
+| `SHADE_TREE_LIBC` | detected | `gnu` or `musl`; required when neither `ldd` nor the dynamic loader identifies the libc |
+| `SHADE_TREE_RELEASE_BASE` | GitHub Releases | `https://` only; `file://` and loopback `http://` are accepted for the selftest and local mirrors |
+
+Notes:
+
+- The npm CLI (`npm install --global git+...`) is also called `shade-tree`; it
+  keeps that name for the Proxy, `shade-tree run`, and the operator commands.
+  If both are on `PATH` the earlier directory wins; the installer lists every
+  other `shade-tree` it finds and says which one your shell will run. In the
+  examples below, the `identity` command belongs to the npm CLI; every other
+  `shade-tree` command is the Rust binary (`./target/release/shade-tree` from
+  source, `~/.local/bin/shade-tree` after this installer).
+- Live egress still needs the npm CLI once, to export `identity.json` at your
+  enrolled tier. Each Rust `egress` run picks its own slot, so until
+  [issue #75](https://github.com/dmarzzz/shade-tree-node/issues/75) is fixed
+  make at most one `egress` invocation per member secret per protocol epoch
+  (120 seconds by default), counting any attempt that may have reached a node.
+  `--slot-cursor` is best-effort and wraps at K; do not rely on it.
+- On Windows the installer runs from Git Bash or MSYS2 (x86_64) and installs
+  `shade-tree.exe`. PowerShell users download the asset and its `.sha256` by
+  hand and compare the digest with `Get-FileHash` as shown below.
+
 ## Download
 
 Choose an asset from the [latest release](https://github.com/dmarzzz/shade-tree-node/releases/latest).
@@ -64,14 +106,18 @@ shade-tree verify-receipt receipt.json --onion <onion>
 
 Live egress requires an identity and the membership set committed by the
 gateway. Get the exact enrolled tier from the Grove operator. Generate the
-identity with the npm CLI at that tier, then use the live Rust build:
+identity with the npm CLI at that tier, then run the live Rust build by its
+path: the one-line install puts it in `~/.local/bin`, a source build in
+`./target/release`:
 
 ```bash
 read -s SHADE_TREE_SECRET && export SHADE_TREE_SECRET
 read -r SHADE_TREE_LIMIT && export SHADE_TREE_LIMIT
+# The identity command belongs to the npm CLI. If the Rust client shadows it on PATH,
+# call the npm CLI by path: node "$(npm root -g)/shade-tree-node/bin/shade-tree.mjs" ...
 shade-tree identity --limit "$SHADE_TREE_LIMIT" --out identity.json
 
-./target/release/shade-tree egress \
+"${SHADE_TREE_INSTALL_DIR:-$HOME/.local/bin}/shade-tree" egress \
   --directory directory.json \
   --signer <ed25519-hex> \
   --identity identity.json \