@coworker-jp/aidr 0.1.296 → 0.1.298

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.296",
+  "version": "0.1.298",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/templates.mjs

@@ -230,9 +230,34 @@ fi
 # only ever describes the machine's CURRENT state.
 rm -f "$UNSCANNED_STAMP"
 
-# Binary exists — throttled self-update check
+# Binary exists — throttled self-update check.
+#
+# The self-update goes to the license server BAKED INTO the binary, not to
+# DOWNLOAD_BASE. So a binary built for another environment keeps updating itself
+# from that environment forever: its key is rejected, detection logs are refused
+# with 403, and the batch is discarded. Nothing about that is visible here —
+# the hook is fail-open, so the session still looks protected (issue #1860).
+#
+# Two things follow, and they are separate:
+#   1. If the binary names a DIFFERENT license server than the one this
+#      installation downloads from, no key this installation has can ever
+#      license it. Re-download from DOWNLOAD_BASE — that is the only path back.
+#      A missing/odd "version" output leaves the binary alone (fail-open), but
+#      says so, because "we did not check" must not read as "it is fine".
+#   2. Do not swallow the update result. A failed self-update is a fact the
+#      operator can act on; "|| true" turned it into silence.
 if should_check_update; then
-    "$BIN" update 2>/dev/null || true
+    want_host=$(printf '%s' "$DOWNLOAD_BASE" | sed -E 's#^[a-z]+://([^/]+).*#\\1#')
+    have_host=$("$BIN" version 2>/dev/null | sed -n 's#^server: [a-z]*://\\([^/]*\\).*#\\1#p' | head -1)
+    if [ -n "$have_host" ] && [ -n "$want_host" ] && [ "$have_host" != "$want_host" ]; then
+        echo "ai-scanner: the installed binary talks to $have_host, but this installation provisions from $want_host, so its access key can never be accepted (detection logs are refused and discarded). Re-downloading the matching binary." >&2
+        download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" || \\
+            echo "ai-scanner: could not replace the mismatched binary: \${UNVERIFIED_REASON:-the download failed}. Scanning continues locally, but detection logs will keep being refused. Re-run the installer, or contact your IT administrator with this message." >&2
+    elif [ -z "$have_host" ]; then
+        echo "ai-scanner: could not read which license server the installed binary uses, so the environment match was NOT checked. If detection logs are being refused, re-run the installer." >&2
+    fi
+    "$BIN" update 2>/dev/null || \\
+        echo "ai-scanner: the scanner could not update itself just now. It keeps scanning with the rules it already has; if this repeats, re-run the installer or contact your IT administrator." >&2
     date +%s > "$PULL_STAMP"
 fi