feat: update Go to 1.25.6 and fix Claude Code installer execution on noexec /tmp filesystems

- Update GO_VERSION from 1.25.5 to 1.25.6
- Update SHA256 checksums for Go downloads (linux_amd64 and linux_arm64)
- Change downloadInstaller() to use /var/tmp instead of /tmp to avoid noexec mount restrictions
- Add fallback to os.TempDir() if /var/tmp doesn't exist
- Fix installer permissions when running as root for another user (chmod 0755 before su execution)
- Add comments explaining noexec workaround an

Author: CodeMonkeyCybersecurity

install.sh

@@ -5,8 +5,8 @@ trap 'echo " Installation failed on line $LINENO"; exit 1' ERR
 log() { echo "[$1] $2"; }
 
 declare -A GO_CHECKSUMS=(
-  ["linux_amd64"]="9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b"
-  ["linux_arm64"]="b00b694903d126c588c378e72d3545549935d3982635ba3f7a964c9fa23fe3b9"
+  ["linux_amd64"]="f022b6aad78e362bcba9b0b94d09ad58c5a70c6ba3b7582905fababf5fe0181a"
+  ["linux_arm64"]="738ef87d79c34272424ccdf83302b7b0300b8b096ed443896089306117943dd5"
 )
 
 GITHUB_CLI_KEY_SHA256="20e0125d6f6e077a9ad46f03371bc26d90b04939fb95170f5a1905099cc6bcc0"
@@ -63,7 +63,7 @@ Eos_BUILD_PATH="$Eos_SRC_DIR/$Eos_BINARY_NAME"
 INSTALL_PATH="/usr/local/bin/$Eos_BINARY_NAME"
 
 # Go installation settings
-GO_VERSION="1.25.5"
+GO_VERSION="1.25.6"
 GO_INSTALL_DIR="/usr/local"
 
 # --- Directories ---

pkg/remotecode/install.go

@@ -541,6 +541,15 @@ func installClaudeCode(rc *eos_io.RuntimeContext, config *Config, result *Instal
 	}
 	defer os.Remove(installerPath)
 
+	// If running as root but installing for another user, we need to make the
+	// installer readable by that user. The file is created with 0700 by default.
+	if config.User != "" && config.User != "root" && os.Geteuid() == 0 {
+		// Make the installer readable and executable by everyone (it's a temp file)
+		if err := os.Chmod(installerPath, 0755); err != nil {
+			logger.Warn("Failed to chmod installer for user access", zap.Error(err))
+		}
+	}
+
 	installCmd := exec.Command("bash", installerPath)
 	if config.User != "" && config.User != "root" && os.Geteuid() == 0 {
 		installCmd = exec.Command("su", "-", config.User, "-c", fmt.Sprintf("bash %s", installerPath))
@@ -714,6 +723,9 @@ func installWindsurf(rc *eos_io.RuntimeContext, config *Config, result *InstallR
 // downloadInstaller downloads an installer script to a temp file
 // NOTE: This trusts the source URL (Anthropic's infrastructure for Claude Code)
 // similar to how users would manually run: curl -fsSL https://claude.ai/install.sh | bash
+//
+// We use /var/tmp instead of /tmp because /tmp is often mounted with noexec
+// for security reasons, which prevents running scripts from there.
 func downloadInstaller(url string) (string, error) {
 	resp, err := http.Get(url)
 	if err != nil {
@@ -723,7 +735,15 @@ func downloadInstaller(url string) (string, error) {
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("failed to download installer: HTTP %d from %s", resp.StatusCode, url)
 	}
-	file, err := os.CreateTemp("", "claude-installer-*.sh")
+
+	// Use /var/tmp instead of /tmp - /tmp often has noexec mount option
+	// which prevents script execution. /var/tmp typically allows execution.
+	tempDir := "/var/tmp"
+	if _, err := os.Stat(tempDir); os.IsNotExist(err) {
+		tempDir = os.TempDir() // Fall back to default if /var/tmp doesn't exist
+	}
+
+	file, err := os.CreateTemp(tempDir, "claude-installer-*.sh")
 	if err != nil {
 		return "", fmt.Errorf("failed to create temporary installer file: %w", err)
 	}