@aryaminus/controlkeel 0.3.63 → 0.3.66

package/README.md

@@ -2,7 +2,7 @@
 
 This package is a bootstrap installer for the native ControlKeel CLI.
 
-Both npmjs and GitHub Packages publish the same bootstrap package. The native binary is downloaded from GitHub Releases on first use, not during installation.
+The npm and GitHub Packages channels use the same bootstrap package when published. The native binary is downloaded from the matching versioned GitHub Release on first use, not during installation.
 
 ## Install
 
@@ -17,7 +17,7 @@ npx @aryaminus/controlkeel@latest
 
 The package installs the `controlkeel` command. The native binary is automatically downloaded on first use.
 
-Published companion packages that tie into the main CLI:
+Companion package names used by supported host install paths:
 
 - [`@aryaminus/controlkeel-opencode`](https://www.npmjs.com/package/@aryaminus/controlkeel-opencode) for OpenCode plugin installs
 - [`@aryaminus/controlkeel-pi-extension`](https://www.npmjs.com/package/@aryaminus/controlkeel-pi-extension) for Pi extension installs
@@ -29,6 +29,8 @@ Main project docs:
 - [Agent integrations](https://github.com/aryaminus/controlkeel/blob/main/docs/agent-integrations.md)
 - [Support matrix](https://github.com/aryaminus/controlkeel/blob/main/docs/support-matrix.md)
 
+After the first run, complete the repo-local path with `controlkeel setup`, `controlkeel attach <host>`, `controlkeel attach doctor`, `controlkeel provider doctor`, `controlkeel status`, and `controlkeel findings`.
+
 You can also install the same bootstrap package from GitHub Packages:
 
 ```bash
@@ -42,12 +44,12 @@ npm i -g @aryaminus/controlkeel --registry=https://npm.pkg.github.com
 This package uses a lazy download model for maximum security:
 
 - No install scripts (removed postinstall)
-- No environment variable access (hardcoded configuration)
+- Fixed release repository and package version; environment flags cannot redirect the download source
 - Plain GitHub Release URLs for transparent scanner and reviewer visibility
 - SHA-256 checksum verification for all downloads
 
 The native binary is downloaded on first use rather than during installation. For detailed information about security practices, see [SECURITY.md](SECURITY.md).
 
-For manual installation, download the binary from [GitHub Releases](https://github.com/aryaminus/controlkeel/releases/latest) and place it in the `vendor/` directory.
+For manual installation, download the matching binary and checksum from [GitHub Releases](https://github.com/aryaminus/controlkeel/releases/latest). Release bundles or manifests may support local plugin installation, but they do not imply publication in a host's public marketplace.
 
 <!-- mcp-name: io.github.aryaminus/controlkeel -->

package/SECURITY.md

@@ -25,8 +25,9 @@ The package uses a **lazy download model** - the native binary is downloaded on
 1. User runs `controlkeel` or imports the package programmatically
 2. Installer detects platform (OS and architecture) using Node.js built-ins
 3. Downloads appropriate binary from official GitHub Releases
-4. Verifies SHA-256 checksum against release's `SHASUMS256.txt`
-5. Caches binary locally for subsequent uses
+4. Verifies SHA-256 checksum against the release's `controlkeel-checksums.txt`
+5. Verifies the keyless cosign signature when cosign is available; set `CONTROLKEEL_REQUIRE_SIGNATURE=1` to fail closed when signature material is unavailable
+6. Caches binary locally for subsequent uses
 
 **Supported Platforms**
 
@@ -43,7 +44,7 @@ The package uses a **lazy download model** - the native binary is downloaded on
 | Measure | Implementation | Threat Mitigated |
 |---------|---------------|------------------|
 | No Install Scripts | Removed all `postinstall` and lifecycle scripts | Code execution during install |
-| No Environment Variables | Removed all `process.env` usage; hardcoded configuration | Configuration-based attacks |
+| Fixed Download Source | Repository and package version cannot be overridden | Configuration-based redirect attacks |
 | Plain URLs | Plaintext, auditable URL strings (base64 removed) | Auditability; no hidden network destinations |
 | Hardcoded Repository | Fixed to `aryaminus/controlkeel` | Repository redirect attacks |
 | HTTPS Only | All downloads use HTTPS | Man-in-the-middle attacks |
@@ -53,7 +54,7 @@ The package uses a **lazy download model** - the native binary is downloaded on
 
 ### Configuration
 
-**Hardcoded Values** (cannot be overridden):
+**Hardcoded download values** (cannot be overridden):
 
 - Repository: `aryaminus/controlkeel`
 - Version: Matched to package.json version
@@ -66,6 +67,8 @@ The package uses a **lazy download model** - the native binary is downloaded on
 - `CONTROLKEEL_SKIP_DOWNLOAD` - Skip auto-download
 - `CONTROLKEEL_ALLOW_CUSTOM_SOURCE` - Custom source guard
 
+`CONTROLKEEL_SKIP_SIGNATURE` and `CONTROLKEEL_REQUIRE_SIGNATURE` only control optional cosign verification. SHA-256 verification is mandatory in the npm bootstrap and cannot be disabled.
+
 **Rationale**: Hardcoding eliminates attack vectors from environment variable manipulation or configuration redirection.
 
 ---
@@ -83,8 +86,8 @@ The package uses a **lazy download model** - the native binary is downloaded on
 
 - **Status**: ✅ RESOLVED
 - **Original Issue**: Package accessed `process.env.CONTROLKEEL_*` variables
-- **Resolution**: Removed all `process.env` usage; configuration hardcoded
-- **Verification**: `grep -r "process\.env" --include="*.js"` returns no matches
+- **Resolution**: Removed environment overrides for the repository, version, and download source; those values are hardcoded
+- **Verification**: Download URL construction does not read environment variables
 
 ### Alert: URL Strings
 

package/lib/install.js

@@ -232,18 +232,29 @@ async function ensureBinary({ forceDownload = false } = {}) {
 
   ensureVendorDir();
   const asset = assetName();
-  const tempPath = path.join(os.tmpdir(), `${asset}-${Date.now()}`);
+  const tempPath = `${destination}.${process.pid}.tmp`;
   const url = `${releaseBaseUrl()}/${asset}`;
 
-  await download(url, tempPath);
-  await verifyChecksum(tempPath, asset);
-  await verifySignature(tempPath, asset, releaseBaseUrl());
-
-  fs.copyFileSync(tempPath, destination);
-  fs.rmSync(tempPath, { force: true });
+  try {
+    await download(url, tempPath);
+    await verifyChecksum(tempPath, asset);
+    await verifySignature(tempPath, asset, releaseBaseUrl());
+
+    // On Windows, fs.renameSync can fail if the destination already exists
+    // (e.g. forced refresh). Fall back to copy+unlink for atomic-ish replace.
+    try {
+      fs.renameSync(tempPath, destination);
+    } catch (renameErr) {
+      if (!fs.existsSync(destination)) throw renameErr;
+      fs.copyFileSync(tempPath, destination);
+      fs.rmSync(tempPath, { force: true });
+    }
 
-  if (process.platform !== "win32") {
-    fs.chmodSync(destination, 0o755);
+    if (process.platform !== "win32") {
+      fs.chmodSync(destination, 0o755);
+    }
+  } finally {
+    fs.rmSync(tempPath, { force: true });
   }
 
   return destination;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryaminus/controlkeel",
-  "version": "0.3.63",
+  "version": "0.3.66",
   "description": "Bootstrap installer for the ControlKeel native CLI - a control plane for agent-generated software delivery.",
   "license": "Apache-2.0",
   "author": {

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/aryaminus/controlkeel.git",
     "source": "github"
   },
-  "version": "0.3.63",
+  "version": "0.3.66",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aryaminus/controlkeel",
-      "version": "0.3.63",
+      "version": "0.3.66",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"