@autodevjapan/godd-mcp-alpha 2.9.2 → 2.9.4

package/godd-tk-assets.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": 1,
+  "releaseTag": "godd-tk-v0.1.0",
+  "targets": {
+    "darwin-arm64": {
+      "artifact": "godd-tk-aarch64-apple-darwin",
+      "bytes": 1450928,
+      "sha256": "7560ed51aacfcf278e02557339355b5a16a6c45965e3f10b1e47f15d2e14582e"
+    },
+    "darwin-x64": {
+      "artifact": "godd-tk-x86_64-apple-darwin",
+      "bytes": 1686888,
+      "sha256": "8771dcb838271ef32b1077cd104c582386c38403bb8ccf28986c3f957a762fee"
+    },
+    "linux-x64": {
+      "artifact": "godd-tk-x86_64-unknown-linux-musl",
+      "bytes": 2147096,
+      "sha256": "6c81e2fef94338540371bcf144d376f7cfc7a68b170f08749ecf7f08a550d5be"
+    },
+    "win32-x64": {
+      "artifact": "godd-tk-x86_64-pc-windows-msvc.exe",
+      "bytes": 1647104,
+      "sha256": "875918e53546d8730a3d28149a333498443704b45ef1cc41a3b7d098865e5f18"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autodevjapan/godd-mcp-alpha",
-  "version": "2.9.2",
+  "version": "2.9.4",
   "type": "module",
   "description": "Senior-engineering workflows for AI coding clients — plan, build, test, review, and ship with one command",
   "license": "UNLICENSED",
@@ -18,10 +18,12 @@
     "assets/godd-mcp-alpha-icon.png",
     "assets/native",
     "native-assets.json",
+    "godd-tk-assets.json",
     "dist/godd.cjs",
     "scripts/postinstall.js",
     "scripts/postinstall-godd-native.js",
     "scripts/native-assets.js",
+    "scripts/godd-tk-assets.js",
     "scripts/postinstall-godd-tk.js",
     "scripts/write-sha256.js",
     "README.md"

package/scripts/godd-tk-assets.js

@@ -0,0 +1,154 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+const MANIFEST_KEYS = ["releaseTag", "schemaVersion", "targets"];
+const TARGET_KEYS = ["artifact", "bytes", "sha256"];
+const EXPECTED_TARGET_ARTIFACTS = Object.freeze({
+  "darwin-arm64": "godd-tk-aarch64-apple-darwin",
+  "darwin-x64": "godd-tk-x86_64-apple-darwin",
+  "linux-x64": "godd-tk-x86_64-unknown-linux-musl",
+  "win32-x64": "godd-tk-x86_64-pc-windows-msvc.exe",
+});
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+export const GODD_TK_RELEASE_TAG_PATTERN = /^godd-tk-v\d+\.\d+\.\d+$/;
+
+/**
+ * godd-tk の取得物が pinned release と一致しなかったときの終了コード。
+ *
+ * `postinstall.js` は godd-tk を `required:false`（opt-in）として扱うため、
+ * 通常の失敗（プラットフォーム未対応 / `gh` 不在 / ダウンロード失敗）は
+ * exit 0 = 「取得しない」として install を続行させる。
+ * それと **区別** して「取得したが digest が一致しない」= 供給経路の改竄疑い
+ * だけをこの専用コードで表現し、`postinstall.js` 側で install 全体を
+ * fail-closed に倒す。sysexits.h の EX_DATAERR に合わせて 65 を使う。
+ */
+export const GODD_TK_INTEGRITY_EXIT_CODE = 65;
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function requireExactKeys(value, expected, label) {
+  if (!isRecord(value)) throw new Error(`${label} must be an object`);
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  if (JSON.stringify(actual) !== JSON.stringify(sortedExpected)) {
+    throw new Error(
+      `${label} keys mismatch: expected=${sortedExpected.join(",")} actual=${actual.join(",")}`,
+    );
+  }
+}
+
+export function validateGoddTkManifest(value) {
+  requireExactKeys(value, MANIFEST_KEYS, "godd-tk manifest");
+  if (value.schemaVersion !== 1) {
+    throw new Error("godd-tk manifest schemaVersion must be 1");
+  }
+  if (
+    typeof value.releaseTag !== "string" ||
+    !GODD_TK_RELEASE_TAG_PATTERN.test(value.releaseTag)
+  ) {
+    throw new Error("godd-tk manifest releaseTag is invalid");
+  }
+  requireExactKeys(
+    value.targets,
+    Object.keys(EXPECTED_TARGET_ARTIFACTS),
+    "godd-tk manifest targets",
+  );
+  const artifacts = new Set();
+  for (const [target, expectedArtifact] of Object.entries(
+    EXPECTED_TARGET_ARTIFACTS,
+  )) {
+    const entry = value.targets[target];
+    requireExactKeys(entry, TARGET_KEYS, `godd-tk manifest target ${target}`);
+    if (entry.artifact !== expectedArtifact) {
+      throw new Error(`godd-tk manifest artifact mismatch for ${target}`);
+    }
+    if (artifacts.has(entry.artifact)) {
+      throw new Error(`godd-tk manifest artifact is duplicated: ${entry.artifact}`);
+    }
+    artifacts.add(entry.artifact);
+    if (!Number.isSafeInteger(entry.bytes) || entry.bytes <= 0) {
+      throw new Error(`godd-tk manifest bytes are invalid for ${target}`);
+    }
+    if (typeof entry.sha256 !== "string" || !SHA256_PATTERN.test(entry.sha256)) {
+      throw new Error(`godd-tk manifest SHA-256 is invalid for ${target}`);
+    }
+  }
+  return value;
+}
+
+function deepFreeze(value) {
+  if (!isRecord(value)) return value;
+  for (const nested of Object.values(value)) deepFreeze(nested);
+  return Object.freeze(value);
+}
+
+/**
+ * drift gate も postinstall も、この manifest を「期待値」として読む。
+ * 浅い freeze だと `manifest.targets[t].sha256` を実行時に書き換えられ、
+ * 期待値そのものが可変になってしまうため深く凍結する。
+ */
+export const GODD_TK_MANIFEST = deepFreeze(
+  validateGoddTkManifest(
+    JSON.parse(readFileSync(join(packageRoot, "godd-tk-assets.json"), "utf8")),
+  ),
+);
+
+/**
+ * postinstall が取得するリリースタグ。
+ *
+ * 期待 digest と同じファイルに置くことが陳腐化対策の中核。
+ * タグだけを別の定数として持つと「タグは新しいのに digest は古い」状態が
+ * 作れてしまうため、**タグの単一の出どころはこの manifest だけ**にする。
+ * 新しい godd-tk release を配布対象にするには manifest 全体を差し替える必要が
+ * あり、tag と digest が構造的に分岐できない。
+ */
+export const GODD_TK_RELEASE_TAG = GODD_TK_MANIFEST.releaseTag;
+
+export const GODD_TK_TARGETS = Object.freeze(
+  Object.fromEntries(
+    Object.entries(GODD_TK_MANIFEST.targets).map(([target, value]) => [
+      target,
+      Object.freeze({ ...value }),
+    ]),
+  ),
+);
+
+export function getGoddTkTarget(platform, arch, targets = GODD_TK_TARGETS) {
+  const key = `${platform}-${arch}`;
+  return Object.hasOwn(targets, key) ? targets[key] : null;
+}
+
+export function checksumBuffer(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+
+/**
+ * 取得済みファイルを manifest の bytes / sha256 と照合する。
+ * 不一致は必ず throw する（戻り値の真偽値では表現しない）。
+ */
+export function verifyGoddTkArtifact(
+  path,
+  target,
+  read = readFileSync,
+  stat = statSync,
+) {
+  const size = stat(path).size;
+  if (size !== target.bytes) {
+    throw new Error(
+      `godd-tk size mismatch for ${target.artifact}: expected=${target.bytes} actual=${size}`,
+    );
+  }
+  const sha256 = checksumBuffer(read(path));
+  if (sha256 !== target.sha256) {
+    throw new Error(
+      `godd-tk SHA-256 mismatch for ${target.artifact}: expected=${target.sha256} actual=${sha256}`,
+    );
+  }
+  return { bytes: size, sha256 };
+}

package/scripts/postinstall-godd-tk.js

@@ -3,46 +3,44 @@
 /**
  * GoDD Token Killer — postinstall script
  *
- * Downloads the pre-built godd-tk binary for the current OS/arch
- * from GitHub Releases via `gh` CLI (supports private repos) and
- * places it in ~/.local/bin/ (Unix) or %LOCALAPPDATA%/godd-tk/ (Windows).
+ * Downloads the pinned pre-built godd-tk binary from GitHub Releases via the
+ * `gh` CLI (supports private repos), verifies it against the committed
+ * `godd-tk-assets.json` manifest (size + SHA-256), and only then places it in
+ * ~/.local/bin/ (Unix) or %LOCALAPPDATA%/godd-tk/ (Windows).
+ *
+ * 真正性の根拠は `gh` の TLS/認証**ではなく**、リポジトリにコミットされ
+ * レビューを通った manifest の digest である（Issue #1474）。
  */
 
-import { mkdirSync, chmodSync, existsSync, renameSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, unlinkSync } from "node:fs";
+import { join, resolve } from "node:path";
 import { homedir, platform, arch } from "node:os";
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+  GODD_TK_INTEGRITY_EXIT_CODE,
+  GODD_TK_RELEASE_TAG,
+  getGoddTkTarget,
+  verifyGoddTkArtifact,
+} from "./godd-tk-assets.js";
 
 const REPO = "AutoDevJapan/GoDD-MCP-Alpha";
 const BINARY_NAME = "godd-tk";
-const VERSION_TAG = "godd-tk-v0.1.0";
-
-const TARGETS = {
-  "darwin-x64": "godd-tk-x86_64-apple-darwin",
-  "darwin-arm64": "godd-tk-aarch64-apple-darwin",
-  "linux-x64": "godd-tk-x86_64-unknown-linux-musl",
-  "win32-x64": "godd-tk-x86_64-pc-windows-msvc.exe",
-};
-
-function getInstallDir() {
-  if (platform() === "win32") {
-    const localAppData = process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local");
+
+export function getInstallDir(currentPlatform = platform(), environment = process.env) {
+  if (currentPlatform === "win32") {
+    const localAppData = environment.LOCALAPPDATA || join(homedir(), "AppData", "Local");
     return join(localAppData, "godd-tk");
   }
   return join(homedir(), ".local", "bin");
 }
 
-function getTarget() {
-  const key = `${platform()}-${arch()}`;
-  return TARGETS[key];
-}
-
-function getBinaryPath(installDir) {
-  const ext = platform() === "win32" ? ".exe" : "";
+export function getBinaryPath(installDir, currentPlatform = platform()) {
+  const ext = currentPlatform === "win32" ? ".exe" : "";
   return join(installDir, `${BINARY_NAME}${ext}`);
 }
 
-function isGhAvailable() {
+function defaultIsGhAvailable() {
   try {
     execFileSync("gh", ["--version"], { stdio: "ignore", timeout: 5000 });
     return true;
@@ -51,76 +49,231 @@ function isGhAvailable() {
   }
 }
 
-async function main() {
-  const target = getTarget();
+function defaultDownload(tag, artifact, directory) {
+  execFileSync(
+    "gh",
+    [
+      "release",
+      "download",
+      tag,
+      "--repo",
+      REPO,
+      "--pattern",
+      artifact,
+      "--dir",
+      directory,
+      "--clobber",
+    ],
+    { stdio: "pipe", timeout: 60000 },
+  );
+}
+
+/**
+ * 返す `status` は 3 系統を厳密に区別する:
+ *   - "installed" / "already-installed" … 検証済みバイナリが所定の場所にある
+ *   - "skipped"                        … そもそも取得しない（exit 0、install 継続）。
+ *                                        既存の未検証バイナリが居た場合は必ず隔離済み
+ *   - "integrity-failure"              … 検証を通らないバイナリを実行経路から
+ *                                        外せなかった（exit 65 で fail-closed）
+ */
+export function installGoddTk({
+  currentPlatform = platform(),
+  currentArch = arch(),
+  installDir = getInstallDir(currentPlatform),
+  isGhAvailable = defaultIsGhAvailable,
+  download = defaultDownload,
+  verify = verifyGoddTkArtifact,
+  exists = existsSync,
+  makeDir = (path) => mkdirSync(path, { recursive: true }),
+  // staging は必ず install 先と同じファイルシステム上に作る。
+  // os.tmpdir() を使うと /tmp が tmpfs / $HOME が別デバイスの環境で
+  // rename が常に EXDEV になり、検証機能そのものが無言で死ぬ。
+  makeTempDir = (parent) => mkdtempSync(join(parent, ".godd-tk-")),
+  removeTree = (path) => rmSync(path, { recursive: true, force: true }),
+  move = renameSync,
+  removeFile = unlinkSync,
+  chmod = chmodSync,
+  now = () => Date.now(),
+  log = console.log,
+  logError = console.error,
+} = {}) {
+  const target = getGoddTkTarget(currentPlatform, currentArch);
   if (!target) {
-    console.log(`[godd-tk] No pre-built binary for ${platform()}-${arch()}, skipping.`);
-    console.log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
-    return;
+    log(`[godd-tk] No pre-built binary for ${currentPlatform}-${currentArch}, skipping.`);
+    log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+    return { status: "skipped", reason: "unsupported-platform" };
   }
 
-  const installDir = getInstallDir();
-  const binaryPath = getBinaryPath(installDir);
-
-  if (existsSync(binaryPath)) {
+  const binaryPath = getBinaryPath(installDir, currentPlatform);
+  let unverifiedExisting = false;
+  if (exists(binaryPath)) {
     try {
-      const version = execFileSync(binaryPath, ["--version"], { encoding: "utf8" }).trim();
-      console.log(`[godd-tk] Already installed: ${version}`);
-      return;
-    } catch {
-      // corrupted binary, re-download
+      verify(binaryPath, target);
+      log(`[godd-tk] Already installed and verified: ${binaryPath} (${GODD_TK_RELEASE_TAG})`);
+      return { status: "already-installed", binaryPath };
+    } catch (error) {
+      // 既存バイナリが pinned release と違う（自前ビルド・旧バージョン・改竄）。
+      // 「検証済み」と偽らず、pinned release での置き換えを試みる。
+      unverifiedExisting = true;
+      logError(
+        `[godd-tk] Existing binary does not match the pinned release ${GODD_TK_RELEASE_TAG}: ` +
+          `${error instanceof Error ? error.message : error}`,
+      );
+      log(`[godd-tk] Reinstalling the pinned, digest-verified release.`);
     }
   }
 
-  if (!isGhAvailable()) {
-    console.log(`[godd-tk] GitHub CLI (gh) not found — required for private repo download.`);
-    console.log(`[godd-tk] Install gh: https://cli.github.com/ then run this script again.`);
-    console.log(`[godd-tk] Or build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
-    return;
+  /**
+   * 「取得できなかった」経路の共通終端。
+   *
+   * 既存の未検証バイナリを検知していた場合、ここで黙って exit 0 に戻ると
+   * 未検証バイナリが実行経路に残り続ける（= 無言スキップ）。必ず隔離し、
+   * 隔離できないときだけ fail-closed に倒す。
+   */
+  function finishWithoutInstall(reason) {
+    if (!unverifiedExisting || !exists(binaryPath)) {
+      return { status: "skipped", reason };
+    }
+    // rename は宛先を黙って上書きする。クロックが巻き戻る環境（NTP バックステップ /
+    // スナップショット復元 / 固定クロックのコンテナ）で先行隔離物を消すと、
+    // 隔離の目的である証跡保全そのものが失われるため必ず空きパスを探す。
+    const stamp = now();
+    let quarantinePath = `${binaryPath}.unverified-${stamp}`;
+    for (let suffix = 1; exists(quarantinePath); suffix += 1) {
+      if (suffix > 1000) {
+        logError(
+          `[godd-tk] SECURITY: could not find a free quarantine path for ${binaryPath}.`,
+        );
+        return { status: "integrity-failure", reason: "unverified-existing-binary" };
+      }
+      quarantinePath = `${binaryPath}.unverified-${stamp}-${suffix}`;
+    }
+    try {
+      move(binaryPath, quarantinePath);
+    } catch (error) {
+      logError(
+        `[godd-tk] SECURITY: could not quarantine the unverified binary at ${binaryPath} — ` +
+          `${error instanceof Error ? error.message : error}`,
+      );
+      return { status: "integrity-failure", reason: "unverified-existing-binary" };
+    }
+    logError(
+      `[godd-tk] Quarantined the unverified binary to ${quarantinePath}; ` +
+        `it is no longer on the install path. Delete it once you have confirmed its origin.`,
+    );
+    return { status: "skipped", reason };
   }
 
-  console.log(`[godd-tk] Downloading ${target} via gh CLI...`);
-
+  // 想定外の例外が `unverifiedExisting === true` のまま escape すると、
+  // 未検証バイナリを隔離しないまま install が続いてしまう（M2 と同じクラスの穴）。
+  // 取得〜配置の全体を包み、必ず finishWithoutInstall を通す。
+  // `integrity-failure` は throw ではなく return なので、この catch で降格することはない。
   try {
-    mkdirSync(installDir, { recursive: true });
-
-    const tmpDir = join(installDir, ".godd-tk-tmp");
-    mkdirSync(tmpDir, { recursive: true });
-
-    execSync(
-      `gh release download ${VERSION_TAG} --repo ${REPO} --pattern "${target}" --dir "${tmpDir}" --clobber`,
-      { stdio: "pipe", timeout: 60000 }
+    return runDownloadAndInstall();
+  } catch (error) {
+    logError(
+      `[godd-tk] Unexpected installer error: ${error instanceof Error ? error.message : error}`,
     );
+    return finishWithoutInstall("unexpected-error");
+  }
 
-    const downloadedPath = join(tmpDir, target);
-    if (!existsSync(downloadedPath)) {
-      throw new Error(`Downloaded file not found at ${downloadedPath}`);
+  function runDownloadAndInstall() {
+    if (!isGhAvailable()) {
+      log(`[godd-tk] GitHub CLI (gh) not found — required for private repo download.`);
+      log(`[godd-tk] Install gh: https://cli.github.com/ then run this script again.`);
+      log(`[godd-tk] Or build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+      return finishWithoutInstall("gh-unavailable");
     }
 
-    if (existsSync(binaryPath)) unlinkSync(binaryPath);
-    renameSync(downloadedPath, binaryPath);
+    log(`[godd-tk] Downloading ${target.artifact} (${GODD_TK_RELEASE_TAG}) via gh CLI...`);
 
-    if (platform() !== "win32") {
-      chmodSync(binaryPath, 0o755);
+    let tmpDir;
+    try {
+      makeDir(installDir);
+      tmpDir = makeTempDir(installDir);
+    } catch (error) {
+      log(
+        `[godd-tk] Could not prepare a staging directory under ${installDir}: ` +
+          `${error instanceof Error ? error.message : error}`,
+      );
+      return finishWithoutInstall("staging-unavailable");
     }
 
-    // Clean up temp dir
-    try { unlinkSync(tmpDir); } catch {}
+    const downloadedPath = join(tmpDir, target.artifact);
+    try {
+      try {
+        download(GODD_TK_RELEASE_TAG, target.artifact, tmpDir);
+      } catch (error) {
+        log(`[godd-tk] Download failed: ${error instanceof Error ? error.message : error}`);
+        log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+        return finishWithoutInstall("download-failed");
+      }
+      if (!exists(downloadedPath)) {
+        log(`[godd-tk] Downloaded file not found at ${downloadedPath}`);
+        log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+        return finishWithoutInstall("download-failed");
+      }
+
+      // ここから先は「取得できた」ケース。digest 不一致は skip ではなく失敗。
+      try {
+        verify(downloadedPath, target);
+      } catch (error) {
+        logError(
+          `[godd-tk] SECURITY: downloaded artifact failed integrity verification — ` +
+            `${error instanceof Error ? error.message : error}`,
+        );
+        logError(
+          `[godd-tk] The artifact published at ${GODD_TK_RELEASE_TAG} does not match the digest ` +
+            `committed in godd-mcp-alpha/godd-tk-assets.json. Installation is aborted and nothing was installed.`,
+        );
+        return { status: "integrity-failure", reason: "digest-mismatch" };
+      }
+
+      try {
+        if (exists(binaryPath)) removeFile(binaryPath);
+        move(downloadedPath, binaryPath);
+      } catch (error) {
+        log(`[godd-tk] Installation failed: ${error instanceof Error ? error.message : error}`);
+        log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+        return finishWithoutInstall("install-failed");
+      }
+      // ここまで来た時点で、置かれているのは検証済み bytes だけ。
+      unverifiedExisting = false;
 
-    console.log(`[godd-tk] Installed to ${binaryPath}`);
-    console.log(`[godd-tk] Run 'godd-tk init --agent cursor' to set up hooks`);
+      if (currentPlatform !== "win32") {
+        try {
+          chmod(binaryPath, 0o755);
+        } catch (error) {
+          logError(
+            `[godd-tk] Installed verified bytes but could not set the executable bit on ${binaryPath}: ` +
+              `${error instanceof Error ? error.message : error}`,
+          );
+        }
+      }
 
-    // Add to PATH hint for Windows
-    if (platform() === "win32") {
-      const pathDirs = (process.env.PATH || "").toLowerCase().split(";");
-      if (!pathDirs.includes(installDir.toLowerCase())) {
-        console.log(`[godd-tk] Add ${installDir} to your PATH for global access`);
+      log(`[godd-tk] Installed and verified (sha256 ${target.sha256}): ${binaryPath}`);
+      log(`[godd-tk] Run 'godd-tk init --agent cursor' to set up hooks`);
+      if (currentPlatform === "win32") {
+        const pathDirs = (process.env.PATH || "").toLowerCase().split(";");
+        if (!pathDirs.includes(installDir.toLowerCase())) {
+          log(`[godd-tk] Add ${installDir} to your PATH for global access`);
+        }
+      }
+      return { status: "installed", binaryPath };
+    } finally {
+      try {
+        removeTree(tmpDir);
+      } catch {
+        // best effort
       }
     }
-  } catch (err) {
-    console.log(`[godd-tk] Download failed: ${err.message}`);
-    console.log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
   }
 }
 
-main().catch(console.error);
+export function toExitCode(result) {
+  return result.status === "integrity-failure" ? GODD_TK_INTEGRITY_EXIT_CODE : 0;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = toExitCode(installGoddTk());
+}

package/scripts/postinstall.js

@@ -5,6 +5,11 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptsDirectory = dirname(fileURLToPath(import.meta.url));
+
+// `godd-tk-assets.js` は import 時に manifest を読んで検証する I/O モジュールなので、
+// `required:true` の godd-native 経路まで巻き込まないようここでは値だけを持つ。
+// `GODD_TK_INTEGRITY_EXIT_CODE` との同値は tests/godd-tk-asset-integrity.test.ts が固定する。
+const GODD_TK_INTEGRITY_EXIT_CODE = 65;
 export const INSTALLERS = [
   { name: "godd-native", script: "postinstall-godd-native.js", required: true },
   {
@@ -12,12 +17,21 @@ export const INSTALLERS = [
     script: "postinstall-godd-tk.js",
     required: false,
     optInEnvironment: "GODD_INSTALL_GODD_TK",
+    // opt-in の任意コンポーネントでも、供給経路の完全性検証に失敗した場合だけは
+    // install 全体を失敗させる（無言スキップ禁止 / Issue #1474）。
+    integrityExitCode: GODD_TK_INTEGRITY_EXIT_CODE,
   },
 ];
 
 export function runInstallers(execute = spawnSync) {
   let failed = false;
-  for (const { name, script, required, optInEnvironment } of INSTALLERS) {
+  for (const {
+    name,
+    script,
+    required,
+    optInEnvironment,
+    integrityExitCode,
+  } of INSTALLERS) {
     if (
       optInEnvironment &&
       process.env[optInEnvironment] !== "1"
@@ -34,10 +48,25 @@ export function runInstallers(execute = spawnSync) {
     if (result.error) {
       console.error(`[${name}] Installer could not be executed: ${result.error.message}`);
       if (required) failed = true;
+    } else if (result.status === null) {
+      // spawnSync は timeout / シグナル kill で status:null, signal:"SIGTERM" を返す。
+      // 「非ゼロ終了」と一緒くたにせず、何も検証できていないことを明示する。
+      console.error(
+        `[${name}] Installer was terminated by signal ${result.signal ?? "unknown"}; nothing was verified.`,
+      );
+      if (required) failed = true;
     } else if (result.status !== 0) {
       if (required) {
         console.error(`[${name}] Required installer exited with status ${result.status}; installation failed.`);
         failed = true;
+      } else if (
+        integrityExitCode !== undefined &&
+        result.status === integrityExitCode
+      ) {
+        console.error(
+          `[${name}] Artifact integrity verification failed (status ${result.status}); installation failed.`,
+        );
+        failed = true;
       } else {
         console.error(`[${name}] Optional installer exited with status ${result.status}; MCP installation continues without this optional component.`);
       }