Problem

The non-Alpine Claude Code installer currently executes:

curl -fsSL https://downloads.claude.ai/claude-code-releases/bootstrap.sh |
  bash -s -- <version>

A transient DNS/connectivity failure fails agent setup immediately, while a stalled transfer can consume the outer setup timeout without useful attempt evidence. Piping a retried download directly into a shell would also be unsafe because a partial transfer could be executed.

Required behavior

• Download the bootstrap script to a temporary file first.
• Bound connection time, each transfer, total retry time, and total attempts.
• Retry only this idempotent download for transient DNS/connectivity/HTTP failures.
• Execute the script only after one complete successful download.
• Remove the temporary file on every terminal path.
• Preserve explicit version selection and the Alpine npm path.
• Do not retry the installer script itself after execution begins.
• Keep Harbor's existing outer setup timeout authoritative.

Validation

Add focused tests for the generated command and an execution-level test with a local fake downloader/server proving:

• one transient download failure can recover;
• attempts and elapsed time are bounded;
• a partial failed download is never executed;
• a permanent failure remains a setup error with useful stderr;
• the requested Claude Code version is still passed exactly once;
• temporary files are removed.

Closure proof

Close when focused tests and the installed-agent suite pass and the command succeeds after one injected transient download failure without replaying installer execution.