@autodevjapan/godd-mcp-alpha 2.9.3 → 2.10.0

package/scripts/godd-tk-assets.js

@@ -0,0 +1,154 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+const MANIFEST_KEYS = ["releaseTag", "schemaVersion", "targets"];
+const TARGET_KEYS = ["artifact", "bytes", "sha256"];
+const EXPECTED_TARGET_ARTIFACTS = Object.freeze({
+  "darwin-arm64": "godd-tk-aarch64-apple-darwin",
+  "darwin-x64": "godd-tk-x86_64-apple-darwin",
+  "linux-x64": "godd-tk-x86_64-unknown-linux-musl",
+  "win32-x64": "godd-tk-x86_64-pc-windows-msvc.exe",
+});
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+export const GODD_TK_RELEASE_TAG_PATTERN = /^godd-tk-v\d+\.\d+\.\d+$/;
+
+/**
+ * godd-tk の取得物が pinned release と一致しなかったときの終了コード。
+ *
+ * `postinstall.js` は godd-tk を `required:false`（opt-in）として扱うため、
+ * 通常の失敗（プラットフォーム未対応 / `gh` 不在 / ダウンロード失敗）は
+ * exit 0 = 「取得しない」として install を続行させる。
+ * それと **区別** して「取得したが digest が一致しない」= 供給経路の改竄疑い
+ * だけをこの専用コードで表現し、`postinstall.js` 側で install 全体を
+ * fail-closed に倒す。sysexits.h の EX_DATAERR に合わせて 65 を使う。
+ */
+export const GODD_TK_INTEGRITY_EXIT_CODE = 65;
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function requireExactKeys(value, expected, label) {
+  if (!isRecord(value)) throw new Error(`${label} must be an object`);
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  if (JSON.stringify(actual) !== JSON.stringify(sortedExpected)) {
+    throw new Error(
+      `${label} keys mismatch: expected=${sortedExpected.join(",")} actual=${actual.join(",")}`,
+    );
+  }
+}
+
+export function validateGoddTkManifest(value) {
+  requireExactKeys(value, MANIFEST_KEYS, "godd-tk manifest");
+  if (value.schemaVersion !== 1) {
+    throw new Error("godd-tk manifest schemaVersion must be 1");
+  }
+  if (
+    typeof value.releaseTag !== "string" ||
+    !GODD_TK_RELEASE_TAG_PATTERN.test(value.releaseTag)
+  ) {
+    throw new Error("godd-tk manifest releaseTag is invalid");
+  }
+  requireExactKeys(
+    value.targets,
+    Object.keys(EXPECTED_TARGET_ARTIFACTS),
+    "godd-tk manifest targets",
+  );
+  const artifacts = new Set();
+  for (const [target, expectedArtifact] of Object.entries(
+    EXPECTED_TARGET_ARTIFACTS,
+  )) {
+    const entry = value.targets[target];
+    requireExactKeys(entry, TARGET_KEYS, `godd-tk manifest target ${target}`);
+    if (entry.artifact !== expectedArtifact) {
+      throw new Error(`godd-tk manifest artifact mismatch for ${target}`);
+    }
+    if (artifacts.has(entry.artifact)) {
+      throw new Error(`godd-tk manifest artifact is duplicated: ${entry.artifact}`);
+    }
+    artifacts.add(entry.artifact);
+    if (!Number.isSafeInteger(entry.bytes) || entry.bytes <= 0) {
+      throw new Error(`godd-tk manifest bytes are invalid for ${target}`);
+    }
+    if (typeof entry.sha256 !== "string" || !SHA256_PATTERN.test(entry.sha256)) {
+      throw new Error(`godd-tk manifest SHA-256 is invalid for ${target}`);
+    }
+  }
+  return value;
+}
+
+function deepFreeze(value) {
+  if (!isRecord(value)) return value;
+  for (const nested of Object.values(value)) deepFreeze(nested);
+  return Object.freeze(value);
+}
+
+/**
+ * drift gate も postinstall も、この manifest を「期待値」として読む。
+ * 浅い freeze だと `manifest.targets[t].sha256` を実行時に書き換えられ、
+ * 期待値そのものが可変になってしまうため深く凍結する。
+ */
+export const GODD_TK_MANIFEST = deepFreeze(
+  validateGoddTkManifest(
+    JSON.parse(readFileSync(join(packageRoot, "godd-tk-assets.json"), "utf8")),
+  ),
+);
+
+/**
+ * postinstall が取得するリリースタグ。
+ *
+ * 期待 digest と同じファイルに置くことが陳腐化対策の中核。
+ * タグだけを別の定数として持つと「タグは新しいのに digest は古い」状態が
+ * 作れてしまうため、**タグの単一の出どころはこの manifest だけ**にする。
+ * 新しい godd-tk release を配布対象にするには manifest 全体を差し替える必要が
+ * あり、tag と digest が構造的に分岐できない。
+ */
+export const GODD_TK_RELEASE_TAG = GODD_TK_MANIFEST.releaseTag;
+
+export const GODD_TK_TARGETS = Object.freeze(
+  Object.fromEntries(
+    Object.entries(GODD_TK_MANIFEST.targets).map(([target, value]) => [
+      target,
+      Object.freeze({ ...value }),
+    ]),
+  ),
+);
+
+export function getGoddTkTarget(platform, arch, targets = GODD_TK_TARGETS) {
+  const key = `${platform}-${arch}`;
+  return Object.hasOwn(targets, key) ? targets[key] : null;
+}
+
+export function checksumBuffer(buffer) {
+  return createHash("sha256").update(buffer).digest("hex");
+}
+
+/**
+ * 取得済みファイルを manifest の bytes / sha256 と照合する。
+ * 不一致は必ず throw する（戻り値の真偽値では表現しない）。
+ */
+export function verifyGoddTkArtifact(
+  path,
+  target,
+  read = readFileSync,
+  stat = statSync,
+) {
+  const size = stat(path).size;
+  if (size !== target.bytes) {
+    throw new Error(
+      `godd-tk size mismatch for ${target.artifact}: expected=${target.bytes} actual=${size}`,
+    );
+  }
+  const sha256 = checksumBuffer(read(path));
+  if (sha256 !== target.sha256) {
+    throw new Error(
+      `godd-tk SHA-256 mismatch for ${target.artifact}: expected=${target.sha256} actual=${sha256}`,
+    );
+  }
+  return { bytes: size, sha256 };
+}

package/scripts/native-assets.js

@@ -173,12 +173,13 @@ export const EXPECTED_NATIVE_ASSET_FILES = Object.freeze(
 // 気づけない）。到達前に検知するため、警告用の閾値と ratchet 上限を定義する。
 export const NATIVE_ASSET_HEADROOM_WARNING_BYTES = 2_000_000;
 
-// `godd-native-v0.2.10` で観測した baseline（残 headroom 17,486,316 bytes）。
+// `godd-native-v0.2.18` で観測した baseline（残 headroom 16,616,644 bytes）。
+// v0.2.18 releaseの4 binaryと4 checksum合計を固定し、absolute上限の33.23%を残す。
 // これを超える増加は「サイズ削減」か「上限の再設計」の判断を必ず挟ませるため、
 // 単調増加を止める ratchet として固定する（緩めるときは spec の根拠更新とセット）。
 // native release ごとに新しい `baselineBytes` まで引き下げること（spec の
 // 「native release 後のチェックリスト」参照）。据え置くと ratchet が機能しなくなる。
-export const NATIVE_ASSET_BASELINE_CEILING_BYTES = 32_513_684;
+export const NATIVE_ASSET_BASELINE_CEILING_BYTES = 33_383_356;
 
 /**
  * exact 8 files の合計 bytes と `maximumAssetBytes` の余裕を判定する。

package/scripts/postinstall-godd-tk.js

@@ -3,46 +3,54 @@
 /**
  * GoDD Token Killer — postinstall script
  *
- * Downloads the pre-built godd-tk binary for the current OS/arch
- * from GitHub Releases via `gh` CLI (supports private repos) and
- * places it in ~/.local/bin/ (Unix) or %LOCALAPPDATA%/godd-tk/ (Windows).
+ * Downloads the pinned pre-built godd-tk binary from GitHub Releases via the
+ * `gh` CLI (supports private repos), verifies it against the committed
+ * `godd-tk-assets.json` manifest (size + SHA-256), and only then places it in
+ * ~/.local/bin/ (Unix) or %LOCALAPPDATA%/godd-tk/ (Windows).
+ *
+ * 真正性の根拠は `gh` の TLS/認証**ではなく**、リポジトリにコミットされ
+ * レビューを通った manifest の digest である（Issue #1474）。
  */
 
-import { mkdirSync, chmodSync, existsSync, renameSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
 import { homedir, platform, arch } from "node:os";
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+  GODD_TK_INTEGRITY_EXIT_CODE,
+  GODD_TK_RELEASE_TAG,
+  getGoddTkTarget,
+  verifyGoddTkArtifact,
+} from "./godd-tk-assets.js";
+import {
+  AtomicInstallCleanupError,
+  AtomicInstallIntegrityError,
+  AtomicInstallRollbackError,
+  beginAtomicBinaryInstall,
+  finishAtomicBinaryInstall,
+  publishAtomicBinary,
+  recoverAtomicBinaryInstall,
+  recoverInterruptedAtomicFinish,
+} from "./atomic-binary-install.js";
 
 const REPO = "AutoDevJapan/GoDD-MCP-Alpha";
 const BINARY_NAME = "godd-tk";
-const VERSION_TAG = "godd-tk-v0.1.0";
-
-const TARGETS = {
-  "darwin-x64": "godd-tk-x86_64-apple-darwin",
-  "darwin-arm64": "godd-tk-aarch64-apple-darwin",
-  "linux-x64": "godd-tk-x86_64-unknown-linux-musl",
-  "win32-x64": "godd-tk-x86_64-pc-windows-msvc.exe",
-};
-
-function getInstallDir() {
-  if (platform() === "win32") {
-    const localAppData = process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local");
+
+export function getInstallDir(currentPlatform = platform(), environment = process.env) {
+  if (currentPlatform === "win32") {
+    const localAppData = environment.LOCALAPPDATA || join(homedir(), "AppData", "Local");
     return join(localAppData, "godd-tk");
   }
   return join(homedir(), ".local", "bin");
 }
 
-function getTarget() {
-  const key = `${platform()}-${arch()}`;
-  return TARGETS[key];
-}
-
-function getBinaryPath(installDir) {
-  const ext = platform() === "win32" ? ".exe" : "";
+export function getBinaryPath(installDir, currentPlatform = platform()) {
+  const ext = currentPlatform === "win32" ? ".exe" : "";
   return join(installDir, `${BINARY_NAME}${ext}`);
 }
 
-function isGhAvailable() {
+function defaultIsGhAvailable() {
   try {
     execFileSync("gh", ["--version"], { stdio: "ignore", timeout: 5000 });
     return true;
@@ -51,76 +59,288 @@ function isGhAvailable() {
   }
 }
 
-async function main() {
-  const target = getTarget();
+function defaultDownload(tag, artifact, directory) {
+  execFileSync(
+    "gh",
+    [
+      "release",
+      "download",
+      tag,
+      "--repo",
+      REPO,
+      "--pattern",
+      artifact,
+      "--dir",
+      directory,
+      "--clobber",
+    ],
+    { stdio: "pipe", timeout: 60000 },
+  );
+}
+
+/**
+ * 返す `status` は 3 系統を厳密に区別する:
+ *   - "installed" / "already-installed" … 検証済みバイナリが所定の場所にある
+ *   - "skipped"                        … そもそも取得しない（exit 0、install 継続）。
+ *                                        既存の未検証バイナリが居た場合は必ず隔離済み
+ *   - "integrity-failure"              … integrity / atomic recovery 境界の失敗。
+ *                                        rollback成功時もexit 65でfail-closed
+ */
+export function installGoddTk({
+  currentPlatform = platform(),
+  currentArch = arch(),
+  installDir = getInstallDir(currentPlatform),
+  isGhAvailable = defaultIsGhAvailable,
+  download = defaultDownload,
+  verify = verifyGoddTkArtifact,
+  exists = existsSync,
+  makeDir = (path) => mkdirSync(path, { recursive: true }),
+  makeTempDir,
+  removeTree,
+  publishOperations,
+  isProcessAlive,
+  recoverInterruptedFinish =
+    process.env.GODD_RECOVER_GODD_TK_INSTALL === "1",
+  move = renameSync,
+  chmod = chmodSync,
+  now = () => Date.now(),
+  log = console.log,
+  logError = console.error,
+} = {}) {
+  const target = getGoddTkTarget(currentPlatform, currentArch);
   if (!target) {
-    console.log(`[godd-tk] No pre-built binary for ${platform()}-${arch()}, skipping.`);
-    console.log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
-    return;
+    log(`[godd-tk] No pre-built binary for ${currentPlatform}-${currentArch}, skipping.`);
+    log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+    return { status: "skipped", reason: "unsupported-platform" };
   }
 
-  const installDir = getInstallDir();
-  const binaryPath = getBinaryPath(installDir);
+  const binaryPath = getBinaryPath(installDir, currentPlatform);
+  let transaction;
+  try {
+    makeDir(installDir);
+    if (recoverInterruptedFinish) {
+      const recovery = recoverInterruptedAtomicFinish({
+        binaryPath,
+        ...(isProcessAlive ? { isProcessAlive } : {}),
+      });
+      if (recovery.status === "blocked") {
+        logError(
+          `[godd-tk] SECURITY: explicit install recovery was rejected (${recovery.reason}).`,
+        );
+        return { status: "integrity-failure", reason: recovery.reason };
+      }
+      if (recovery.status === "recovered") {
+        log(`[godd-tk] Recovered an interrupted install owner release.`);
+      }
+    }
+    transaction = beginAtomicBinaryInstall({
+      installDir,
+      binaryPath,
+      ...(makeTempDir ? { makeTempDir: (prefix) => makeTempDir(prefix) } : {}),
+      ...(isProcessAlive ? { isProcessAlive } : {}),
+    });
+  } catch {
+    logError(
+      `[godd-tk] SECURITY: could not create the atomic install transaction.`,
+    );
+    return { status: "integrity-failure", reason: "transaction-unavailable" };
+  }
+  if (transaction.status === "busy") {
+    log(`[godd-tk] Another verified install transaction is active; skipping this attempt.`);
+    return { status: "skipped", reason: "install-busy" };
+  }
+  if (transaction.status === "blocked") {
+    logError(`[godd-tk] SECURITY: install lock could not be validated (${transaction.reason}).`);
+    return { status: "integrity-failure", reason: transaction.reason };
+  }
 
-  if (existsSync(binaryPath)) {
+  let result;
+  let retainTransaction = false;
+  try {
+    recoverAtomicBinaryInstall(transaction, (path) => verify(path, target));
+  } catch {
+    logError(`[godd-tk] SECURITY: interrupted install recovery failed.`);
+    result = { status: "integrity-failure", reason: "recovery-failed" };
+  }
+  if (!result) {
     try {
-      const version = execFileSync(binaryPath, ["--version"], { encoding: "utf8" }).trim();
-      console.log(`[godd-tk] Already installed: ${version}`);
-      return;
+      result = runLockedInstall();
     } catch {
-      // corrupted binary, re-download
+      logError(`[godd-tk] Unexpected installer error.`);
+      result = { status: "integrity-failure", reason: "unexpected-error" };
     }
   }
 
-  if (!isGhAvailable()) {
-    console.log(`[godd-tk] GitHub CLI (gh) not found — required for private repo download.`);
-    console.log(`[godd-tk] Install gh: https://cli.github.com/ then run this script again.`);
-    console.log(`[godd-tk] Or build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
-    return;
+  if (retainTransaction) return result;
+  const cleanup = finishAtomicBinaryInstall(
+    transaction,
+    removeTree ? { removeTree } : undefined,
+  );
+  if (!cleanup.ok) {
+    logError(`[godd-tk] SECURITY: install transaction cleanup failed.`);
+    return { status: "integrity-failure", reason: cleanup.reason };
   }
+  return result;
 
-  console.log(`[godd-tk] Downloading ${target} via gh CLI...`);
-
-  try {
-    mkdirSync(installDir, { recursive: true });
-
-    const tmpDir = join(installDir, ".godd-tk-tmp");
-    mkdirSync(tmpDir, { recursive: true });
+  function runLockedInstall() {
+  let unverifiedExisting = false;
+  if (exists(binaryPath)) {
+    try {
+      verify(binaryPath, target);
+      log(`[godd-tk] Already installed and verified (${GODD_TK_RELEASE_TAG}).`);
+      return { status: "already-installed", binaryPath };
+    } catch {
+      // 既存バイナリが pinned release と違う（自前ビルド・旧バージョン・改竄）。
+      // 「検証済み」と偽らず、pinned release での置き換えを試みる。
+      unverifiedExisting = true;
+      logError(
+        `[godd-tk] Existing binary does not match the pinned release ${GODD_TK_RELEASE_TAG}.`,
+      );
+      log(`[godd-tk] Reinstalling the pinned, digest-verified release.`);
+    }
+  }
 
-    execSync(
-      `gh release download ${VERSION_TAG} --repo ${REPO} --pattern "${target}" --dir "${tmpDir}" --clobber`,
-      { stdio: "pipe", timeout: 60000 }
+  /**
+   * 「取得できなかった」経路の共通終端。
+   *
+   * 既存の未検証バイナリを検知していた場合、ここで黙って exit 0 に戻ると
+   * 未検証バイナリが実行経路に残り続ける（= 無言スキップ）。必ず隔離し、
+   * 隔離できないときだけ fail-closed に倒す。
+   */
+  function finishWithoutInstall(reason) {
+    if (!unverifiedExisting || !exists(binaryPath)) {
+      return { status: "skipped", reason };
+    }
+    // rename は宛先を黙って上書きする。クロックが巻き戻る環境（NTP バックステップ /
+    // スナップショット復元 / 固定クロックのコンテナ）で先行隔離物を消すと、
+    // 隔離の目的である証跡保全そのものが失われるため必ず空きパスを探す。
+    const stamp = now();
+    let quarantinePath = `${binaryPath}.unverified-${stamp}`;
+    for (let suffix = 1; exists(quarantinePath); suffix += 1) {
+      if (suffix > 1000) {
+        logError(
+          `[godd-tk] SECURITY: quarantine namespace is exhausted.`,
+        );
+        return { status: "integrity-failure", reason: "unverified-existing-binary" };
+      }
+      quarantinePath = `${binaryPath}.unverified-${stamp}-${suffix}`;
+    }
+    try {
+      move(binaryPath, quarantinePath);
+    } catch {
+      logError(`[godd-tk] SECURITY: could not quarantine the unverified binary.`);
+      return { status: "integrity-failure", reason: "unverified-existing-binary" };
+    }
+    logError(
+      `[godd-tk] Quarantined the unverified binary as ${basename(quarantinePath)}; ` +
+        `it is no longer on the install path. Delete it once you have confirmed its origin.`,
     );
-
-    const downloadedPath = join(tmpDir, target);
-    if (!existsSync(downloadedPath)) {
-      throw new Error(`Downloaded file not found at ${downloadedPath}`);
+    return { status: "skipped", reason };
+  }
+    let ghAvailable;
+    try {
+      ghAvailable = isGhAvailable();
+    } catch {
+      logError(
+        `[godd-tk] Unexpected installer error.`,
+      );
+      return finishWithoutInstall("unexpected-error");
     }
-
-    if (existsSync(binaryPath)) unlinkSync(binaryPath);
-    renameSync(downloadedPath, binaryPath);
-
-    if (platform() !== "win32") {
-      chmodSync(binaryPath, 0o755);
+    if (!ghAvailable) {
+      log(`[godd-tk] GitHub CLI (gh) not found — required for private repo download.`);
+      log(`[godd-tk] Install gh: https://cli.github.com/ then run this script again.`);
+      log(`[godd-tk] Or build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+      return finishWithoutInstall("gh-unavailable");
     }
 
-    // Clean up temp dir
-    try { unlinkSync(tmpDir); } catch {}
+    log(`[godd-tk] Downloading ${target.artifact} (${GODD_TK_RELEASE_TAG}) via gh CLI...`);
+    const downloadedPath = join(transaction.tempDir, target.artifact);
+      try {
+        download(GODD_TK_RELEASE_TAG, target.artifact, transaction.tempDir);
+      } catch {
+        log(`[godd-tk] Download failed.`);
+        log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+        return finishWithoutInstall("download-failed");
+      }
+      if (!exists(downloadedPath)) {
+        log(`[godd-tk] Downloaded artifact is missing (${target.artifact}).`);
+        log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+        return finishWithoutInstall("download-failed");
+      }
+
+      // ここから先は「取得できた」ケース。digest 不一致は skip ではなく失敗。
+      try {
+        verify(downloadedPath, target);
+      } catch {
+        logError(
+          `[godd-tk] SECURITY: downloaded artifact failed integrity verification.`,
+        );
+        logError(
+          `[godd-tk] The artifact published at ${GODD_TK_RELEASE_TAG} does not match the digest ` +
+            `committed in godd-mcp-alpha/godd-tk-assets.json. Installation is aborted and nothing was installed.`,
+        );
+        if (unverifiedExisting && exists(binaryPath)) {
+          const quarantine = finishWithoutInstall("digest-mismatch");
+          if (quarantine.status === "integrity-failure") return quarantine;
+        }
+        return { status: "integrity-failure", reason: "digest-mismatch" };
+      }
 
-    console.log(`[godd-tk] Installed to ${binaryPath}`);
-    console.log(`[godd-tk] Run 'godd-tk init --agent cursor' to set up hooks`);
+      try {
+        if (currentPlatform !== "win32") chmod(downloadedPath, 0o755);
+        publishAtomicBinary(
+          transaction,
+          downloadedPath,
+          (path) => verify(path, target),
+          undefined,
+          publishOperations,
+        );
+      } catch (error) {
+        if (error instanceof AtomicInstallCleanupError) {
+          retainTransaction = true;
+          logError(
+            `[godd-tk] SECURITY: verified publish cleanup is pending; transaction retained.`,
+          );
+          return {
+            status: "integrity-failure",
+            reason: "publish-cleanup-pending",
+          };
+        }
+        if (error instanceof AtomicInstallIntegrityError) {
+          logError(`[godd-tk] SECURITY: published artifact failed integrity verification.`);
+          return {
+            status: "integrity-failure",
+            reason: "post-publish-integrity-failed",
+          };
+        }
+        if (error instanceof AtomicInstallRollbackError) {
+          retainTransaction = true;
+          logError(`[godd-tk] SECURITY: publish rollback failed; transaction retained.`);
+          return { status: "integrity-failure", reason: "rollback-failed" };
+        }
+        log(`[godd-tk] Installation failed.`);
+        log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+        return finishWithoutInstall("install-failed");
+      }
+      // ここまで来た時点で、置かれているのは検証済み bytes だけ。
+      unverifiedExisting = false;
 
-    // Add to PATH hint for Windows
-    if (platform() === "win32") {
-      const pathDirs = (process.env.PATH || "").toLowerCase().split(";");
-      if (!pathDirs.includes(installDir.toLowerCase())) {
-        console.log(`[godd-tk] Add ${installDir} to your PATH for global access`);
+      log(`[godd-tk] Installed and verified (${GODD_TK_RELEASE_TAG}).`);
+      log(`[godd-tk] Run 'godd-tk init --agent cursor' to set up hooks`);
+      if (currentPlatform === "win32") {
+        const pathDirs = (process.env.PATH || "").toLowerCase().split(";");
+        if (!pathDirs.includes(installDir.toLowerCase())) {
+          log(`[godd-tk] Add the godd-tk install directory to PATH for global access`);
+        }
       }
-    }
-  } catch (err) {
-    console.log(`[godd-tk] Download failed: ${err.message}`);
-    console.log(`[godd-tk] Build from source: cd godd-mcp-alpha/godd-tk && cargo build --release`);
+      return { status: "installed", binaryPath };
   }
 }
 
-main().catch(console.error);
+export function toExitCode(result) {
+  return result.status === "integrity-failure" ? GODD_TK_INTEGRITY_EXIT_CODE : 0;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = toExitCode(installGoddTk());
+}

package/scripts/postinstall.js

@@ -5,6 +5,11 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptsDirectory = dirname(fileURLToPath(import.meta.url));
+
+// `godd-tk-assets.js` は import 時に manifest を読んで検証する I/O モジュールなので、
+// `required:true` の godd-native 経路まで巻き込まないようここでは値だけを持つ。
+// `GODD_TK_INTEGRITY_EXIT_CODE` との同値は tests/godd-tk-asset-integrity.test.ts が固定する。
+const GODD_TK_INTEGRITY_EXIT_CODE = 65;
 export const INSTALLERS = [
   { name: "godd-native", script: "postinstall-godd-native.js", required: true },
   {
@@ -12,12 +17,21 @@ export const INSTALLERS = [
     script: "postinstall-godd-tk.js",
     required: false,
     optInEnvironment: "GODD_INSTALL_GODD_TK",
+    // opt-in の任意コンポーネントでも、供給経路の完全性検証に失敗した場合だけは
+    // install 全体を失敗させる（無言スキップ禁止 / Issue #1474）。
+    integrityExitCode: GODD_TK_INTEGRITY_EXIT_CODE,
   },
 ];
 
 export function runInstallers(execute = spawnSync) {
   let failed = false;
-  for (const { name, script, required, optInEnvironment } of INSTALLERS) {
+  for (const {
+    name,
+    script,
+    required,
+    optInEnvironment,
+    integrityExitCode,
+  } of INSTALLERS) {
     if (
       optInEnvironment &&
       process.env[optInEnvironment] !== "1"
@@ -34,10 +48,25 @@ export function runInstallers(execute = spawnSync) {
     if (result.error) {
       console.error(`[${name}] Installer could not be executed: ${result.error.message}`);
       if (required) failed = true;
+    } else if (result.status === null) {
+      // spawnSync は timeout / シグナル kill で status:null, signal:"SIGTERM" を返す。
+      // 「非ゼロ終了」と一緒くたにせず、何も検証できていないことを明示する。
+      console.error(
+        `[${name}] Installer was terminated by signal ${result.signal ?? "unknown"}; nothing was verified.`,
+      );
+      if (required) failed = true;
     } else if (result.status !== 0) {
       if (required) {
         console.error(`[${name}] Required installer exited with status ${result.status}; installation failed.`);
         failed = true;
+      } else if (
+        integrityExitCode !== undefined &&
+        result.status === integrityExitCode
+      ) {
+        console.error(
+          `[${name}] Artifact integrity verification failed (status ${result.status}); installation failed.`,
+        );
+        failed = true;
       } else {
         console.error(`[${name}] Optional installer exited with status ${result.status}; MCP installation continues without this optional component.`);
       }