fix: harden release and runtime installs

.github/workflows/release.yml

@@ -173,6 +173,7 @@ jobs:
           path: target/distrib/
           merge-multiple: true
       - name: Install dependencies
+        if: ${{ matrix.packages_install != null && matrix.packages_install != '' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -187,7 +188,24 @@ jobs:
           fi
 
           # cargo-dist emits apt-get install without -y; keep release jobs non-interactive.
-          sed -i -E 's/^([[:space:]]*sudo[[:space:]]+)?apt-get[[:space:]]+install[[:space:]]+/\1apt-get install -y /' "$install_script"
+          awk '
+            /^[[:space:]]*sudo[[:space:]]+apt-get[[:space:]]+install([[:space:]]|$)/ {
+              if ($0 !~ /(^|[[:space:]])(-y|--yes)([[:space:]]|$)/) {
+                sub(/sudo[[:space:]]+apt-get[[:space:]]+install[[:space:]]+/, "sudo apt-get install -y ")
+              }
+              print
+              next
+            }
+            /^[[:space:]]*apt-get[[:space:]]+install([[:space:]]|$)/ {
+              if ($0 !~ /(^|[[:space:]])(-y|--yes)([[:space:]]|$)/) {
+                sub(/apt-get[[:space:]]+install[[:space:]]+/, "apt-get install -y ")
+              }
+              print
+              next
+            }
+            { print }
+          ' "$install_script" > "${install_script}.normalized"
+          mv "${install_script}.normalized" "$install_script"
           DEBIAN_FRONTEND=noninteractive bash -euxo pipefail "$install_script"
       - name: Build artifacts
         run: |

crates/vx-runtime/src/runtime/install_impl.rs

@@ -98,15 +98,11 @@ pub async fn default_install_inner(
     );
     debug!("Executable relative path: {}", params.exe_relative);
 
-    // Check if already installed
-    if let Some(result) = already_installed_result(&params, version, &install_path, ctx) {
-        return Ok(result);
-    }
-
     let _install_lock = InstallLock::acquire(&install_path).await?;
 
-    // Another vx process may have completed the install while this process was
-    // waiting for the lock. Re-check before cleaning or downloading.
+    // Hold the lock before trusting files in the install directory. Another vx
+    // process may have created the executable path while extraction is still in
+    // progress, especially on Windows archive installs.
     if let Some(result) = already_installed_result(&params, version, &install_path, ctx) {
         return Ok(result);
     }