[Fhatu12]

What changed

• Resolve the Windows archive extractor as %SystemRoot%\System32\tar.exe instead of relying on PATH ordering.
• Fail clearly when SystemRoot or the Windows system tar is unavailable; do not fall back to an arbitrary PATH executable on Windows.
• Preserve non-Windows tar behavior and the existing argument-array invocation.
• Add a network-free Node regression suite and register it in make test.

Why

When Git for Windows GNU tar is first on PATH, it can interpret the colon in an absolute drive-letter archive path as remote-archive syntax. The npm installer then fails after download and checksum verification, even though the same archive extracts successfully with the Windows system bsdtar.

Selecting %SystemRoot%\System32\tar.exe avoids dependence on PATH ordering while retaining the existing SHA-256 verification before extraction. No dependencies are added.

Fixes #41

Reproduction and verification

Validated implementation: e687910d5045e88a98079ad2bfb2062d2eb03705, based on 8ab057d4dd479277789b989821ebd3425dead9e7.

• Baseline native Windows reproduction with Git GNU tar first on the child PATH: exit 1 with Cannot connect to C: resolve failed.
• Exact same archive with %SystemRoot%\System32\tar.exe: extraction succeeds and fixture contents match.
• Native Windows 10, Node.js 24.14.0: 7 applicable Node tests passed, 0 failed, 1 Linux-only test skipped. This covers drive-letter paths, spaces, Latin café, hostile PATH tar, real Git GNU tar precedence, missing/invalid extractor, extraction failure, and checksum mismatch.
• Linux/WSL Node suite: 6 passed, 0 failed, 2 Windows-only tests skipped; the non-Windows PATH tar wrapper was invoked.
• sh scripts/test-installer-strict.sh: passed under both sh and bash.
• python3 -m unittest discover -s tests -p test_installer.py: 16/16 passed.
• node --check npm/install.js and node --check npm/install.test.js: passed.
• git diff --check: passed.

The complete repository test suite is not claimed as passing. make test reaches inherited Rust compilation failures for missing commands::doctor::share_report, a doctor::run argument mismatch, and a non-exhaustive telemetry match. The same failures were reproduced at the unchanged baseline; this PR changes no Rust files.

Known limitations

• A CJK archive/destination path failed on the tested Windows 10 system bsdtar 3.5.2. This compatibility limitation is accepted for this scoped change and is not claimed fixed.
• Windows 11 and native macOS were not independently tested. The issue reporter's Windows 11 environment uses a newer system bsdtar.
• Existing installer hardening opportunities, including malformed/absent checksum handling, archive-entry validation, independent release signatures, and failure-artifact cleanup, are inherited and are not claimed fixed here.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T15:49:19.283933Z	e687910	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.