@binoctal/open-agents-bridge 0.6.1 → 0.6.2

package/install.js

@@ -2,8 +2,11 @@ const https = require("https");
 const fs = require("fs");
 const path = require("path");
 const os = require("os");
+const crypto = require("crypto");
 const { execSync } = require("child_process");
 
+const PACKAGE_VERSION = require("./package.json").version;
+
 const REPO_OWNER = "binoctal";
 const REPO_NAME = "open-agents-bridge";
 const BINARY_NAME = "open-agents-bridge";
@@ -61,6 +64,66 @@ function fetchJSON(url) {
   });
 }
 
+function fetchText(url) {
+  return new Promise((resolve, reject) => {
+    https
+      .get(url, { headers: { "User-Agent": "open-agents-bridge-npm" } }, (res) => {
+        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+          return fetchText(res.headers.location).then(resolve, reject);
+        }
+        if (res.statusCode !== 200) {
+          return reject(new Error(`HTTP ${res.statusCode} from ${url}`));
+        }
+        let data = "";
+        res.on("data", (chunk) => (data += chunk));
+        res.on("end", () => resolve(data));
+      })
+      .on("error", reject);
+  });
+}
+
+function sha256(filePath) {
+  return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+}
+
+// Verify the download against the release's own checksums.txt. A missing
+// checksums.txt aborts rather than skipping the check: whoever can swap an
+// asset can also make checksums.txt 404, so "skip when absent" verifies
+// nothing at all. The bridge is a long-lived daemon that takes commands from
+// a remote, and install time is the one cheap chance to confirm the bytes are
+// the ones that were published.
+async function verifyChecksum(release, asset, filePath) {
+  const checksums = release.assets.find((a) => a.name === "checksums.txt");
+  if (!checksums) {
+    fs.unlinkSync(filePath);
+    throw new Error(
+      `Release ${release.tag_name} has no checksums.txt; refusing to install an unverified binary`
+    );
+  }
+
+  const text = await fetchText(checksums.browser_download_url);
+  const line = text
+    .split("\n")
+    .map((l) => l.trim().split(/\s+/))
+    .find((parts) => parts[1] === asset.name || parts[1] === `*${asset.name}`);
+
+  if (!line) {
+    fs.unlinkSync(filePath);
+    throw new Error(`checksums.txt does not list ${asset.name}`);
+  }
+
+  const expected = line[0].toLowerCase();
+  const actual = sha256(filePath);
+  if (expected !== actual) {
+    fs.unlinkSync(filePath);
+    throw new Error(
+      `Checksum mismatch for ${asset.name}\n  expected: ${expected}\n  actual:   ${actual}`
+    );
+  }
+
+  console.log(`Checksum verified (sha256 ${actual.slice(0, 16)}…)`);
+}
+
 function downloadFile(url, destPath) {
   return new Promise((resolve, reject) => {
     const file = fs.createWriteStream(destPath);
@@ -94,18 +157,23 @@ async function install() {
 
   console.log(`Detecting platform: ${goos}/${goarch}`);
 
-  // Get latest release from GitHub
-  const apiUrl = `https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/releases/latest`;
-  console.log("Fetching latest release...");
+  // Fetch the release matching THIS package's version, not "latest". Pulling
+  // latest means the npm version and the binary version have nothing to do
+  // with each other: a lockfile pins the package but not what the package
+  // downloads, so the same lockfile installs different binaries over time.
+  const tag = `v${PACKAGE_VERSION}`;
+  const apiUrl = `https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/releases/tags/${tag}`;
+  console.log(`Fetching release ${tag}...`);
 
   let release;
   try {
     release = await fetchJSON(apiUrl);
   } catch (err) {
+    console.error(`Failed to fetch release ${tag} of ${REPO_OWNER}/${REPO_NAME}.`);
+    console.error(`  Error: ${err.message}`);
     console.error(
-      "Failed to fetch release info. If you are installing from source, build the binary manually."
+      "  This package installs the binary built for its own version; it does not fall back to the latest release."
     );
-    console.error(`  Error: ${err.message}`);
     process.exit(1);
   }
 
@@ -133,9 +201,12 @@ async function install() {
 
   console.log(`Downloading ${asset.name}...`);
 
+  const downloadPath = path.join(binDir, asset.name);
+  await downloadFile(asset.browser_download_url, downloadPath);
+  await verifyChecksum(release, asset, downloadPath);
+
   if (asset.name.endsWith(".tar.gz")) {
-    const tmpArchive = path.join(binDir, asset.name);
-    await downloadFile(asset.browser_download_url, tmpArchive);
+    const tmpArchive = downloadPath;
 
     // Extract the binary from tarball
     try {
@@ -150,8 +221,7 @@ async function install() {
     }
     fs.unlinkSync(tmpArchive);
   } else if (asset.name.endsWith(".zip")) {
-    const tmpArchive = path.join(binDir, asset.name);
-    await downloadFile(asset.browser_download_url, tmpArchive);
+    const tmpArchive = downloadPath;
 
     // Extract using built-in or system unzip
     try {
@@ -167,8 +237,8 @@ async function install() {
     }
     fs.unlinkSync(tmpArchive);
   } else {
-    // Plain binary
-    await downloadFile(asset.browser_download_url, binaryPath);
+    // Plain binary — already downloaded and verified, just put it in place.
+    fs.renameSync(downloadPath, binaryPath);
   }
 
   // Make executable (unix)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binoctal/open-agents-bridge",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Bridge CLI for Open Agents - connect your devices to the agent network",
   "bin": {
     "open-agents-bridge": "./run.js"