@autodevjapan/godd-mcp-alpha 1.46.3 → 2.0.1

package/native-assets.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": 1,
+  "releaseTag": "godd-native-v0.1.1",
+  "expectedVersion": "godd-native 0.1.1",
+  "baselineBytes": 43422580,
+  "maximumAssetBytes": 48000000,
+  "maximumTarballBytes": 25000000,
+  "maximumUnpackedBytes": 50000000,
+  "targets": {
+    "darwin-x64": {
+      "artifact": "godd-native-x86_64-apple-darwin",
+      "bytes": 11027072,
+      "sha256": "2cdac18a4fefa3983c882402376a3557b3224f45b8857f5181f6afca80edfc61"
+    },
+    "darwin-arm64": {
+      "artifact": "godd-native-aarch64-apple-darwin",
+      "bytes": 10689840,
+      "sha256": "d0e2af0d6d6486f4472ebd06b35783ca3b00a9154c7df965e7fddee0ffeb305c"
+    },
+    "linux-x64": {
+      "artifact": "godd-native-x86_64-unknown-linux-musl",
+      "bytes": 12479168,
+      "sha256": "ca2bc844643569a627a15ee1476d6cc51d4b594f9b7bcb81f1e70d39e0b3b317"
+    },
+    "win32-x64": {
+      "artifact": "godd-native-x86_64-pc-windows-msvc.exe",
+      "bytes": 9226240,
+      "sha256": "c912e4add2f0d3c438d3d507cb38837e032e5cd0a2b9d89b29b3a8480e24c5c8"
+    }
+  }
+}

package/package.json

@@ -1,18 +1,26 @@
 {
   "name": "@autodevjapan/godd-mcp-alpha",
-  "version": "1.46.3",
+  "version": "2.0.1",
   "type": "module",
   "description": "GoDD MCP α Server — AI Prompt Delivery System for Cursor, Claude Code, Codex, Kimi CLI, and Antigravity",
   "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AutoDevJapan/GoDD-MCP-Alpha.git",
+    "directory": "godd-mcp-alpha"
+  },
   "main": "dist/godd.cjs",
   "bin": {
     "godd-a": "dist/godd.cjs"
   },
   "files": [
     "assets/godd-mcp-alpha-icon.png",
+    "assets/native",
+    "native-assets.json",
     "dist/godd.cjs",
     "scripts/postinstall.js",
     "scripts/postinstall-godd-native.js",
+    "scripts/native-assets.js",
     "scripts/postinstall-godd-tk.js",
     "scripts/write-sha256.js",
     "README.md"
@@ -38,6 +46,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
+    "gate:v2": "node scripts/dispatch-npm-v2-gate.js",
     "dev": "tsx src/index.ts serve",
     "prepublishOnly": "pnpm build",
     "postinstall": "node scripts/postinstall.js"

package/scripts/native-assets.js

@@ -0,0 +1,185 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+const MANIFEST_KEYS = [
+  "baselineBytes",
+  "expectedVersion",
+  "maximumAssetBytes",
+  "maximumTarballBytes",
+  "maximumUnpackedBytes",
+  "releaseTag",
+  "schemaVersion",
+  "targets",
+];
+const TARGET_KEYS = ["artifact", "bytes", "sha256"];
+const EXPECTED_TARGET_ARTIFACTS = Object.freeze({
+  "darwin-arm64": "godd-native-aarch64-apple-darwin",
+  "darwin-x64": "godd-native-x86_64-apple-darwin",
+  "linux-x64": "godd-native-x86_64-unknown-linux-musl",
+  "win32-x64": "godd-native-x86_64-pc-windows-msvc.exe",
+});
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+const RELEASE_TAG_PATTERN = /^godd-native-v(\d+\.\d+\.\d+)$/;
+const SIDECAR_BYTES = 65;
+const HARD_MAX_UNPACKED_BYTES = 64_000_000;
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function requireExactKeys(value, expected, label) {
+  if (!isRecord(value)) throw new Error(`${label} must be an object`);
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  if (JSON.stringify(actual) !== JSON.stringify(sortedExpected)) {
+    throw new Error(
+      `${label} keys mismatch: expected=${sortedExpected.join(",")} actual=${actual.join(",")}`,
+    );
+  }
+}
+
+function requirePositiveInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${label} must be a positive safe integer`);
+  }
+}
+
+export function validateNativeManifest(value) {
+  requireExactKeys(value, MANIFEST_KEYS, "Native manifest");
+  if (value.schemaVersion !== 1) {
+    throw new Error("Native manifest schemaVersion must be 1");
+  }
+  const tagMatch =
+    typeof value.releaseTag === "string"
+      ? RELEASE_TAG_PATTERN.exec(value.releaseTag)
+      : null;
+  if (!tagMatch) throw new Error("Native manifest releaseTag is invalid");
+  if (value.expectedVersion !== `godd-native ${tagMatch[1]}`) {
+    throw new Error("Native manifest tag/version mismatch");
+  }
+  requirePositiveInteger(value.baselineBytes, "baselineBytes");
+  requirePositiveInteger(value.maximumAssetBytes, "maximumAssetBytes");
+  requirePositiveInteger(value.maximumTarballBytes, "maximumTarballBytes");
+  requirePositiveInteger(value.maximumUnpackedBytes, "maximumUnpackedBytes");
+  if (value.maximumUnpackedBytes > HARD_MAX_UNPACKED_BYTES) {
+    throw new Error(
+      `maximumUnpackedBytes exceeds hard ceiling ${HARD_MAX_UNPACKED_BYTES}`,
+    );
+  }
+  requireExactKeys(
+    value.targets,
+    Object.keys(EXPECTED_TARGET_ARTIFACTS),
+    "Native manifest targets",
+  );
+
+  const artifacts = new Set();
+  let expectedBaseline = 0;
+  for (const [target, expectedArtifact] of Object.entries(
+    EXPECTED_TARGET_ARTIFACTS,
+  )) {
+    const entry = value.targets[target];
+    requireExactKeys(entry, TARGET_KEYS, `Native manifest target ${target}`);
+    if (entry.artifact !== expectedArtifact) {
+      throw new Error(`Native manifest artifact mismatch for ${target}`);
+    }
+    if (artifacts.has(entry.artifact)) {
+      throw new Error(`Native manifest artifact is duplicated: ${entry.artifact}`);
+    }
+    artifacts.add(entry.artifact);
+    requirePositiveInteger(entry.bytes, `${target}.bytes`);
+    if (typeof entry.sha256 !== "string" || !SHA256_PATTERN.test(entry.sha256)) {
+      throw new Error(`Native manifest SHA-256 is invalid for ${target}`);
+    }
+    expectedBaseline += entry.bytes + SIDECAR_BYTES;
+  }
+  if (value.baselineBytes !== expectedBaseline) {
+    throw new Error(
+      `Native manifest baseline mismatch: expected=${expectedBaseline} actual=${value.baselineBytes}`,
+    );
+  }
+  if (value.maximumAssetBytes < value.baselineBytes) {
+    throw new Error("maximumAssetBytes must cover baselineBytes");
+  }
+  if (value.maximumUnpackedBytes < value.baselineBytes) {
+    throw new Error("maximumUnpackedBytes must cover baselineBytes");
+  }
+  return value;
+}
+
+export const NATIVE_MANIFEST = Object.freeze(
+  validateNativeManifest(
+    JSON.parse(readFileSync(join(packageRoot, "native-assets.json"), "utf8")),
+  ),
+);
+export const NATIVE_RELEASE_TAG = NATIVE_MANIFEST.releaseTag;
+export const EXPECTED_NATIVE_VERSION = NATIVE_MANIFEST.expectedVersion;
+export const NATIVE_ASSET_BASELINE_BYTES = NATIVE_MANIFEST.baselineBytes;
+export const MAX_NATIVE_ASSET_BYTES = NATIVE_MANIFEST.maximumAssetBytes;
+export const MAX_NPM_TARBALL_BYTES = NATIVE_MANIFEST.maximumTarballBytes;
+export const MAX_NPM_UNPACKED_BYTES = NATIVE_MANIFEST.maximumUnpackedBytes;
+export const NATIVE_ARTIFACTS = Object.freeze(
+  Object.fromEntries(
+    Object.entries(NATIVE_MANIFEST.targets).map(([target, value]) => [
+      target,
+      value.artifact,
+    ]),
+  ),
+);
+export const TRUSTED_NATIVE_ASSETS = Object.freeze(
+  Object.fromEntries(
+    Object.values(NATIVE_MANIFEST.targets).map((value) => [
+      value.artifact,
+      Object.freeze({ bytes: value.bytes, sha256: value.sha256 }),
+    ]),
+  ),
+);
+export const EXPECTED_NATIVE_ASSET_FILES = Object.freeze(
+  Object.values(NATIVE_ARTIFACTS).flatMap((artifact) => [
+    artifact,
+    `${artifact}.sha256`,
+  ]),
+);
+
+export function checksumFile(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+export function verifyBundledNativeAssets(
+  directory,
+  trustedAssets = TRUSTED_NATIVE_ASSETS,
+) {
+  if (!existsSync(directory)) {
+    throw new Error(`Bundled native asset directory is missing: ${directory}`);
+  }
+  const actualFiles = readdirSync(directory).sort();
+  const expectedFiles = [...EXPECTED_NATIVE_ASSET_FILES].sort();
+  if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {
+    throw new Error(
+      `Bundled native asset set mismatch: expected=${expectedFiles.join(",")} actual=${actualFiles.join(",")}`,
+    );
+  }
+  let totalBytes = 0;
+  for (const artifact of Object.values(NATIVE_ARTIFACTS)) {
+    const artifactPath = join(directory, artifact);
+    const checksumPath = `${artifactPath}.sha256`;
+    const expected = readFileSync(checksumPath, "utf8").trim();
+    const trusted = trustedAssets[artifact];
+    if (!trusted) throw new Error(`Trusted manifest is missing ${artifact}`);
+    const bytes = readFileSync(artifactPath).byteLength;
+    if (bytes !== trusted.bytes) throw new Error(`Size mismatch for ${artifact}`);
+    const actual = checksumFile(artifactPath);
+    if (actual !== trusted.sha256 || expected !== trusted.sha256) {
+      throw new Error(`Checksum mismatch for ${artifact}`);
+    }
+    totalBytes += bytes + readFileSync(checksumPath).byteLength;
+  }
+  if (totalBytes > MAX_NATIVE_ASSET_BYTES) {
+    throw new Error(
+      `Bundled native assets exceed ${MAX_NATIVE_ASSET_BYTES} bytes: ${totalBytes}`,
+    );
+  }
+  return { files: expectedFiles, totalBytes };
+}

package/scripts/postinstall-godd-native.js

@@ -1,116 +1,61 @@
 #!/usr/bin/env node
 
-import {
-  chmodSync,
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-} from "node:fs";
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { arch, homedir, platform } from "node:os";
-import { join } from "node:path";
-
-const REPOSITORY = "AutoDevJapan/GoDD-MCP-Alpha";
-const VERSION_TAG = "godd-native-v0.1.0";
-const EXPECTED_VERSION = "godd-native 0.1.0";
-const ARTIFACTS = {
-  "darwin-x64": "godd-native-x86_64-apple-darwin",
-  "darwin-arm64": "godd-native-aarch64-apple-darwin",
-  "linux-x64": "godd-native-x86_64-unknown-linux-gnu",
-  "win32-x64": "godd-native-x86_64-pc-windows-msvc.exe",
-};
-
-function installDirectory() {
-  if (platform() === "win32") {
-    return join(
-      process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local"),
-      "godd-native",
-    );
-  }
-  return join(homedir(), ".local", "bin");
-}
-
-function installedBinary(directory) {
-  return join(directory, platform() === "win32" ? "godd-native.exe" : "godd-native");
+import { chmodSync, existsSync } from "node:fs";
+import { arch, platform } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  EXPECTED_NATIVE_VERSION,
+  NATIVE_ARTIFACTS,
+  verifyBundledNativeAssets,
+} from "./native-assets.js";
+
+const packageDirectory = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+export function isSourceCheckout(packageRoot = packageDirectory) {
+  return (
+    existsSync(join(packageRoot, "native", "Cargo.toml")) &&
+    existsSync(join(packageRoot, "..", ".git"))
+  );
 }
 
-function main() {
-  const artifact = ARTIFACTS[`${platform()}-${arch()}`];
+export function verifyPackagedNative({
+  currentPlatform = platform(),
+  currentArch = arch(),
+  packageRoot = packageDirectory,
+  execute = execFileSync,
+  trustedAssets,
+} = {}) {
+  const artifact = NATIVE_ARTIFACTS[`${currentPlatform}-${currentArch}`];
   if (!artifact) {
-    console.error(`[godd-native] Unsupported platform: ${platform()}-${arch()}`);
-    process.exitCode = 1;
-    return;
-  }
-
-  const directory = installDirectory();
-  const destination = installedBinary(directory);
-  if (existsSync(destination)) {
-    try {
-      const version = execFileSync(destination, ["--version"], {
-        encoding: "utf-8",
-        timeout: 5_000,
-      }).trim();
-      if (version === EXPECTED_VERSION) return;
-    } catch {
-      // Replace a corrupt or incompatible existing binary.
-    }
+    throw new Error(`Unsupported platform: ${currentPlatform}-${currentArch}`);
   }
-
-  try {
-    execFileSync("gh", ["--version"], { stdio: "ignore", timeout: 5_000 });
-  } catch {
-    console.error("[godd-native] GitHub CLI is required to download the private release artifact.");
-    process.exitCode = 1;
-    return;
+  const assetsDirectory = join(packageRoot, "assets", "native");
+  verifyBundledNativeAssets(assetsDirectory, trustedAssets);
+  const binary = join(assetsDirectory, artifact);
+  if (currentPlatform !== "win32") chmodSync(binary, 0o755);
+  const version = execute(binary, ["--version"], {
+    encoding: "utf-8",
+    timeout: 5_000,
+  }).trim();
+  if (version !== EXPECTED_NATIVE_VERSION) {
+    throw new Error(
+      `Native version mismatch: expected=${EXPECTED_NATIVE_VERSION} actual=${version}`,
+    );
   }
+  return binary;
+}
 
-  mkdirSync(directory, { recursive: true });
-  const temporaryDirectory = join(directory, ".download");
-  rmSync(temporaryDirectory, { recursive: true, force: true });
-  mkdirSync(temporaryDirectory, { recursive: true });
-
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   try {
-    execFileSync(
-      "gh",
-      [
-        "release",
-        "download",
-        VERSION_TAG,
-        "--repo",
-        REPOSITORY,
-        "--pattern",
-        `${artifact}*`,
-        "--dir",
-        temporaryDirectory,
-        "--clobber",
-      ],
-      { stdio: "pipe", timeout: 60_000 },
-    );
-    const downloaded = join(temporaryDirectory, artifact);
-    const expectedChecksum = readFileSync(`${downloaded}.sha256`, "utf-8").trim();
-    const actualChecksum = createHash("sha256")
-      .update(readFileSync(downloaded))
-      .digest("hex");
-    if (actualChecksum !== expectedChecksum) {
-      throw new Error(`Checksum mismatch for ${artifact}`);
+    if (isSourceCheckout()) {
+      console.error("[godd-native] Source-checkout install: packaged native verification skipped.");
+    } else {
+      verifyPackagedNative();
     }
-    const staged = `${destination}.tmp`;
-    copyFileSync(downloaded, staged);
-    if (platform() !== "win32") chmodSync(staged, 0o755);
-    rmSync(destination, { force: true });
-    renameSync(staged, destination);
-  } finally {
-    rmSync(temporaryDirectory, { recursive: true, force: true });
+  } catch (error) {
+    console.error(`[godd-native] Installation failed: ${error instanceof Error ? error.message : error}`);
+    process.exitCode = 1;
   }
 }
-
-try {
-  main();
-} catch (error) {
-  console.error(`[godd-native] Installation failed: ${error instanceof Error ? error.message : error}`);
-  process.exitCode = 1;
-}

package/scripts/postinstall.js

@@ -1,25 +1,51 @@
 #!/usr/bin/env node
 
 import { spawnSync } from "node:child_process";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptsDirectory = dirname(fileURLToPath(import.meta.url));
-const installers = [
-  ["godd-native", "postinstall-godd-native.js"],
-  ["godd-tk", "postinstall-godd-tk.js"],
+export const INSTALLERS = [
+  { name: "godd-native", script: "postinstall-godd-native.js", required: true },
+  {
+    name: "godd-tk",
+    script: "postinstall-godd-tk.js",
+    required: false,
+    optInEnvironment: "GODD_INSTALL_GODD_TK",
+  },
 ];
 
-for (const [name, script] of installers) {
-  const result = spawnSync(process.execPath, [join(scriptsDirectory, script)], {
-    stdio: "inherit",
-    timeout: 120_000,
-  });
-  if (result.error) {
-    console.error(`[${name}] Installer could not be executed: ${result.error.message}`);
-  } else if (result.status !== 0) {
-    console.error(
-      `[${name}] Installer exited with status ${result.status}; installation continues and the CLI will verify availability before use.`,
-    );
+export function runInstallers(execute = spawnSync) {
+  let failed = false;
+  for (const { name, script, required, optInEnvironment } of INSTALLERS) {
+    if (
+      optInEnvironment &&
+      process.env[optInEnvironment] !== "1"
+    ) {
+      console.error(
+        `[${name}] Optional installer skipped; set ${optInEnvironment}=1 to opt in.`,
+      );
+      continue;
+    }
+    const result = execute(process.execPath, [join(scriptsDirectory, script)], {
+      stdio: "inherit",
+      timeout: 120_000,
+    });
+    if (result.error) {
+      console.error(`[${name}] Installer could not be executed: ${result.error.message}`);
+      if (required) failed = true;
+    } else if (result.status !== 0) {
+      if (required) {
+        console.error(`[${name}] Required installer exited with status ${result.status}; installation failed.`);
+        failed = true;
+      } else {
+        console.error(`[${name}] Optional installer exited with status ${result.status}; MCP installation continues without this optional component.`);
+      }
+    }
   }
+  return failed ? 1 : 0;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = runInstallers();
 }