fix: apply self-update/README review findings (5 confirmed)

- install.sh: send the GitHub token on the asset + checksums downloads (not just
  API reads), so a PRIVATE-repo install actually works with GITHUB_TOKEN. curl
  drops the auth header on the cross-host CDN redirect (default since 7.58), so
  the token never leaks to storage. Verified end-to-end against the private
  v0.1.0 release.
- README: note that the curl|sh one-liner needs a token while the repo is private
  (accurate token-row wording) and add an Uninstall section (binary + alias
  symlinks + XDG state).
- selfupdate: IsDevBuild now matches the git-describe shape via an anchored regex
  instead of a bare "-g" substring, so valid release tags like v1.0.0-grpc.1 are
  not misclassified as dev builds (+ test). extractBinary uses bytes.NewReader
  instead of copying the whole archive through a string.

make ci + shellcheck green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

README.md

@@ -48,6 +48,10 @@ The installer detects your OS/arch, downloads the matching archive from
 [GitHub Releases](https://github.com/open-source-cloud/devstack/releases),
 **verifies its SHA-256 checksum**, and installs to `$XDG_BIN_HOME` (or `~/.local/bin`).
 
+> **Note:** once the repository's releases are public this works with no auth.
+> While the repo is private, export a token first — e.g.
+> `export GITHUB_TOKEN="$(gh auth token)"`.
+
 <details>
 <summary>Installer options &amp; alternatives</summary>
 
@@ -65,7 +69,7 @@ DEVSTACK_ALIASES="rq uranus" \
 | `DEVSTACK_INSTALL_DIR` | `$XDG_BIN_HOME` or `~/.local/bin` | Where to install the binary. |
 | `DEVSTACK_ALIASES` | *(none)* | Space-separated `argv[0]` alias symlinks. |
 | `DEVSTACK_NO_VERIFY` | `0` | Skip checksum verification (not recommended). |
-| `GITHUB_TOKEN` / `GH_TOKEN` | *(none)* | Auth for the GitHub API (higher rate limits). |
+| `GITHUB_TOKEN` / `GH_TOKEN` | *(none)* | GitHub auth — **required while the repo is private**; also raises API rate limits. |
 
 **From source** (needs Go 1.25+): `make install` (builds a CGO-free static binary
 into `$XDG_BIN_HOME`). **Linux packages**: `.deb` / `.rpm` are attached to each release.
@@ -81,6 +85,18 @@ devstack self update    # download + checksum-verify + atomically replace in pla
 `self update` refuses to overwrite a Homebrew/dpkg/rpm-managed binary, printing the
 right `brew`/`apt`/`dnf` command instead.
 
+### Uninstall
+
+```bash
+rm "$(command -v devstack)"                       # remove the binary
+rm -f "$HOME/.local/bin/rq" "$HOME/.local/bin/uranus"   # remove any argv[0] alias symlinks you added
+```
+
+From a source install, `make uninstall` removes the binary. Machine-global state
+(the SQLite ledger, alias registry, template cache) lives under your XDG data/
+config/cache dirs (`~/.local/share/devstack`, `~/.config/devstack`, …); a managed
+teardown (`workspace destroy`) is on the roadmap.
+
 ## Quickstart
 
 `devstack` discovers your workspace by walking up from the current directory for a

install.sh

@@ -37,12 +37,14 @@ have() { command -v "$1" >/dev/null 2>&1; }
 
 if have curl; then
 	dl() { curl -fsSL "$1"; }
-	dl_to() { curl -fsSL -o "$2" "$1"; }
-	# api adds the auth header (when a token is set) for GitHub API reads only.
+	# dl_to and api send the token when set so PRIVATE-repo asset/API access works.
+	# curl drops the Authorization header on the cross-host redirect to the asset
+	# CDN (default since 7.58), so the token never leaks to storage.
+	dl_to() { if [ -n "$TOKEN" ]; then curl -fsSL -H "Authorization: Bearer $TOKEN" -o "$2" "$1"; else curl -fsSL -o "$2" "$1"; fi; }
 	api() { if [ -n "$TOKEN" ]; then curl -fsSL -H "Authorization: Bearer $TOKEN" "$1"; else curl -fsSL "$1"; fi; }
 elif have wget; then
 	dl() { wget -qO- "$1"; }
-	dl_to() { wget -qO "$2" "$1"; }
+	dl_to() { if [ -n "$TOKEN" ]; then wget -qO "$2" --header="Authorization: Bearer $TOKEN" "$1"; else wget -qO "$2" "$1"; fi; }
 	api() { if [ -n "$TOKEN" ]; then wget -qO- --header="Authorization: Bearer $TOKEN" "$1"; else wget -qO- "$1"; fi; }
 else
 	die "need curl or wget to download devstack"

internal/selfupdate/selfupdate.go

@@ -15,12 +15,18 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"regexp"
 	"strings"
 	"time"
 
 	"golang.org/x/mod/semver"
 )
 
+// describeRe matches the `git describe` suffix (e.g. -11-gabc1234) so a real
+// release tag whose prerelease merely starts with 'g' (v1.0.0-grpc.1) is not
+// mistaken for a dev build.
+var describeRe = regexp.MustCompile(`-[0-9]+-g[0-9a-f]+`)
+
 // Repo is the GitHub repository releases are pulled from.
 const Repo = "open-source-cloud/devstack"
 
@@ -66,7 +72,7 @@ func Check(ctx context.Context, current string) (*CheckResult, error) {
 // `git describe` build like v0.1.0-11-gabc1234, or a -dirty tree) for which
 // semver comparison against a release tag is meaningless.
 func IsDevBuild(v string) bool {
-	return v == "" || v == "dev" || strings.Contains(v, "-g") || strings.HasSuffix(v, "-dirty") || !semver.IsValid(v)
+	return v == "" || v == "dev" || strings.HasSuffix(v, "-dirty") || describeRe.MatchString(v) || !semver.IsValid(v)
 }
 
 // LatestTag resolves the newest release tag, trying /releases/latest first and

internal/selfupdate/selfupdate_test.go

@@ -22,7 +22,9 @@ func TestIsDevBuild(t *testing.T) {
 			t.Errorf("IsDevBuild(%q) = false, want true", v)
 		}
 	}
-	rel := []string{"v0.1.0", "v1.2.3", "v0.2.0"}
+	// Valid release tags, including prereleases whose identifier merely starts
+	// with 'g' — must NOT be treated as dev builds.
+	rel := []string{"v0.1.0", "v1.2.3", "v0.2.0", "v1.0.0-rc.1", "v1.0.0-grpc.1", "v1.0.0-gke", "v1.0.0-go.1"}
 	for _, v := range rel {
 		if IsDevBuild(v) {
 			t.Errorf("IsDevBuild(%q) = true, want false", v)

internal/selfupdate/update.go

@@ -2,6 +2,7 @@ package selfupdate
 
 import (
 	"archive/tar"
+	"bytes"
 	"compress/gzip"
 	"context"
 	"crypto/sha256"
@@ -128,7 +129,7 @@ func checksumFor(sums, filename string) string {
 
 // extractBinary returns the named file's bytes from a .tar.gz archive.
 func extractBinary(archive []byte, name string) ([]byte, error) {
-	gz, err := gzip.NewReader(strings.NewReader(string(archive)))
+	gz, err := gzip.NewReader(bytes.NewReader(archive))
 	if err != nil {
 		return nil, fmt.Errorf("gunzip release: %w", err)
 	}