@campfire-net/campfire-mcp 0.1.2 → 0.4.0

package/index.js

@@ -38,25 +38,50 @@ function getBinaryPath() {
   const cachedBin = path.join(cacheDir, platform === 'win32' ? 'cf-mcp.exe' : 'cf-mcp');
   if (fs.existsSync(cachedBin)) return cachedBin;
 
-  // Download from GitHub Releases
+  // Download from GitHub Releases with checksum verification
+  const crypto = require('crypto');
   const goArch = arch === 'x64' ? 'amd64' : arch;
   const goPlatform = platform;
   const ext = platform === 'win32' ? 'zip' : 'tar.gz';
-  const url = `https://github.com/campfire-net/campfire/releases/latest/download/cf_${goPlatform}_${goArch}.${ext}`;
+  const archiveName = `cf_${goPlatform}_${goArch}.${ext}`;
+  const baseUrl = 'https://github.com/campfire-net/campfire/releases/latest/download';
+  const archiveUrl = `${baseUrl}/${archiveName}`;
+  const checksumsUrl = `${baseUrl}/checksums.txt`;
+  const archivePath = path.join(cacheDir, archiveName);
 
-  process.stderr.write(`campfire-mcp: downloading binary from ${url}\n`);
+  process.stderr.write(`campfire-mcp: downloading ${archiveName}\n`);
   fs.mkdirSync(cacheDir, { recursive: true });
 
   try {
+    // Download archive and checksums
+    execSync(`curl -sL "${archiveUrl}" -o "${archivePath}"`, { stdio: 'pipe' });
+    const checksums = execSync(`curl -sL "${checksumsUrl}"`, { encoding: 'utf8' });
+
+    // Verify SHA256
+    const archiveData = fs.readFileSync(archivePath);
+    const actualHash = crypto.createHash('sha256').update(archiveData).digest('hex');
+    const expectedLine = checksums.split('\n').find(l => l.includes(archiveName));
+    if (!expectedLine) {
+      throw new Error(`checksum not found for ${archiveName}`);
+    }
+    const expectedHash = expectedLine.trim().split(/\s+/)[0];
+    if (actualHash !== expectedHash) {
+      fs.unlinkSync(archivePath);
+      throw new Error(`checksum mismatch: expected ${expectedHash}, got ${actualHash}`);
+    }
+    process.stderr.write(`campfire-mcp: checksum verified\n`);
+
+    // Extract
     if (platform === 'win32') {
-      execSync(`curl -sL "${url}" -o "${cacheDir}/cf.zip" && cd "${cacheDir}" && tar -xf cf.zip cf-mcp.exe`, { stdio: 'pipe' });
+      execSync(`cd "${cacheDir}" && tar -xf "${archivePath}" --strip-components=1 --include='*/cf-mcp.exe'`, { stdio: 'pipe' });
     } else {
-      execSync(`curl -sL "${url}" | tar xz -C "${cacheDir}" --strip-components=1 --wildcards '*/cf-mcp'`, { stdio: 'pipe' });
+      execSync(`tar xzf "${archivePath}" -C "${cacheDir}" --strip-components=1 --wildcards '*/cf-mcp'`, { stdio: 'pipe' });
     }
+    fs.unlinkSync(archivePath);
     fs.chmodSync(cachedBin, 0o755);
     if (fs.existsSync(cachedBin)) return cachedBin;
   } catch (e) {
-    throw new Error(`campfire-mcp: failed to download binary: ${e.message}\nInstall manually: curl -fsSL https://getcampfire.dev/install.sh | sh`);
+    throw new Error(`campfire-mcp: failed to download/verify binary: ${e.message}\nInstall manually: curl -fsSL https://getcampfire.dev/install.sh | sh`);
   }
 
   throw new Error('campfire-mcp: could not find or download binary');

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@campfire-net/campfire-mcp",
-  "version": "0.1.2",
+  "version": "0.4.0",
   "description": "Campfire MCP server — decentralized coordination protocol for AI agents",
   "bin": {
     "campfire-mcp": "index.js"
   },
   "optionalDependencies": {
-    "@campfire-net/campfire-mcp-linux-x64": "0.1.0",
-    "@campfire-net/campfire-mcp-linux-arm64": "0.1.0",
-    "@campfire-net/campfire-mcp-darwin-x64": "0.1.0",
-    "@campfire-net/campfire-mcp-darwin-arm64": "0.1.0",
-    "@campfire-net/campfire-mcp-win32-x64": "0.1.0"
+    "@campfire-net/campfire-mcp-linux-x64": "0.2.0",
+    "@campfire-net/campfire-mcp-linux-arm64": "0.2.0",
+    "@campfire-net/campfire-mcp-darwin-x64": "0.2.0",
+    "@campfire-net/campfire-mcp-darwin-arm64": "0.2.0",
+    "@campfire-net/campfire-mcp-win32-x64": "0.2.0"
   },
   "repository": {
     "type": "git",