@delta-agentcloud/cli 1.1.30 → 1.1.32

package/checksums.txt

@@ -1,5 +1,5 @@
-643aa677f4597ffeca3e96dd87ae2a002355b65e8a51d3be691da4484db6a66b  delta-cli-darwin-amd64.tar.gz
-fbc08c3e7d20830d33afbdd63f1d21d926b9220573afa2a39beb35d3ec8687d5  delta-cli-darwin-arm64.tar.gz
-e2c3e8c78f9b7aebb565bd3680ff948c6362cd9d884f7f34169f0397d4c1402f  delta-cli-linux-amd64.tar.gz
-1475959a99dbc0b7d47385ef1162ac41b1d696bf7ec128b22eefc865e9c21303  delta-cli-linux-arm64.tar.gz
-0dbdc5ca2a2706befde271cbb0077c48810a81aa68abd759344d415b41c36e6f  delta-cli-windows-amd64.zip
+7b0f7b586921d997251890127fb983fb01ab8a2b3c06f8c4eccea108e5a96ebf  delta-cli-darwin-amd64.tar.gz
+e92b9722828a454dc57aeb6ea91f2810ea38fd617c42ecaa25f02f7502f68215  delta-cli-darwin-arm64.tar.gz
+faecf702bca55268c33b5a916053e4fa600d6b0e8f19b9aac1645a4415df2a62  delta-cli-linux-amd64.tar.gz
+31bd5981840b5822e9b20bf58458110d8ff5a182f3baf4940218029fbc6b9fda  delta-cli-linux-arm64.tar.gz
+3382cb55ce3535df1085366513736f14564b1086438c9841983a432bc4e3fa65  delta-cli-windows-amd64.zip

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delta-agentcloud/cli",
-  "version": "1.1.30",
+  "version": "1.1.32",
   "description": "Delta Agent Cloud CLI for sandbox compute and science tools.",
   "bin": {
     "delta-cli": "scripts/run.js"

package/scripts/install.js

@@ -9,23 +9,38 @@ const crypto = require("crypto");
 
 const PKG = "@delta-agentcloud/cli";
 
-// Resolve the version to download:
-//   env var > npm registry > local package.json (fallback)
-function resolveVersion() {
-  if (process.env.DELTA_CLI_VERSION) return process.env.DELTA_CLI_VERSION.replace(/^v/, "");
-  try {
-    const out = require("child_process").execFileSync("npm", ["view", PKG, "version"], {
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15000,
-      encoding: "utf8",
-    });
-    const ver = out.trim();
-    if (/^\d+\.\d+\.\d+/.test(ver)) return ver;
-  } catch {}
-  return require("../package.json").version.replace(/-.*$/, "");
-}
+  // The version of the package npm is installing. Its bundled checksums.txt is
+  // the only checksum source a mirror cannot tamper with, so the downloaded
+  // asset and the expected checksum always have to describe the same version.
+  const PACKAGED_VERSION = require("../package.json").version.replace(/-.*$/, "");
+
+  // The newest version the registry knows about. Used as a fallback when the
+  // packaged version has no matching release.
+  function registryLatestVersion() {
+    try {
+      const out = require("child_process").execFileSync("npm", ["view", PKG, "version"], {
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 15000,
+        encoding: "utf8",
+      });
+      const ver = out.trim();
+      if (/^\d+\.\d+\.\d+/.test(ver)) return ver;
+    } catch {}
+    return null;
+  }
 
-const VERSION = resolveVersion();
+  // Resolve the version to download:
+  //   env var > the packaged version > npm registry (fallback)
+  function resolveVersion() {
+    if (process.env.DELTA_CLI_VERSION) return process.env.DELTA_CLI_VERSION.replace(/^v/, "");
+    // The packaged version is what the user asked npm to install. Resolving to
+    // the registry's "latest" instead downloads the newest asset and verifies it
+    // against this package's older checksums.txt, which can never match.
+    if (PACKAGED_VERSION) return PACKAGED_VERSION;
+    return registryLatestVersion() || PACKAGED_VERSION;
+  }
+
+  const VERSION = resolveVersion();
 const NAME = "delta-cli";
 const REPO = "delta-agentcloud/delta-cli";
 const DEFAULT_ALLOWED_HOSTS = new Set([
@@ -283,14 +298,7 @@ function extractZipWindows(archivePath, destDir) {
 
 // ── Checksum ───────────────────────────────────────────────────────────────
 
-function getExpectedChecksum(archiveName, checksumsDir) {
-  const dir = checksumsDir || path.join(__dirname, "..");
-  const checksumsPath = path.join(dir, "checksums.txt");
-  if (!fs.existsSync(checksumsPath)) {
-    console.error("[WARN] checksums.txt not found, skipping checksum verification");
-    return null;
-  }
-  const content = fs.readFileSync(checksumsPath, "utf8");
+function parseChecksums(content, archiveName) {
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed) continue;
@@ -303,6 +311,45 @@ function getExpectedChecksum(archiveName, checksumsDir) {
   throw new Error(`Checksum entry not found for ${archiveName}`);
 }
 
+function getExpectedChecksum(archiveName, checksumsDir) {
+  const dir = checksumsDir || path.join(__dirname, "..");
+  const checksumsPath = path.join(dir, "checksums.txt");
+  if (!fs.existsSync(checksumsPath)) {
+    console.error("[WARN] checksums.txt not found, skipping checksum verification");
+    return null;
+  }
+  return parseChecksums(fs.readFileSync(checksumsPath, "utf8"), archiveName);
+}
+
+// The canonical URL of one file inside a release, optionally through the
+// configured mirror.
+function releaseFileUrl(version, name) {
+  const url = "https://github.com/" + REPO + "/releases/download/v" + version + "/" + name;
+  const mirror = process.env.DELTA_CLI_MIRROR || "";
+  if (mirror) return mirror.replace(/\/$/, "") + "/" + url;
+  return url;
+}
+
+// The checksum of the release that is actually being downloaded. The bundled
+// checksums.txt only describes the packaged version, so any other version has
+// to bring its own checksums.txt from that same release.
+function expectedChecksumFor(version, archiveName, tmpDir) {
+  if (version === PACKAGED_VERSION) return getExpectedChecksum(archiveName);
+  const dest = path.join(tmpDir, "checksums-" + version + ".txt");
+  try {
+    download(releaseFileUrl(version, "checksums.txt"), dest);
+  } catch (e) {
+    console.error("[WARN] could not fetch checksums for v" + version + ": " + e.message + " — skipping checksum verification");
+    return null;
+  }
+  try {
+    return parseChecksums(fs.readFileSync(dest, "utf8"), archiveName);
+  } catch (e) {
+    console.error("[WARN] " + e.message + " — skipping checksum verification");
+    return null;
+  }
+}
+
 function verifyChecksum(archivePath, expectedHash) {
   if (expectedHash === null) return;
   const hash = crypto.createHash("sha256");
@@ -326,66 +373,85 @@ function verifyChecksum(archivePath, expectedHash) {
 
 // ── Main install ───────────────────────────────────────────────────────────
 
+function extractAndInstall(tmpDir, archivePath) {
+  try {
+    if (isWindows) {
+      console.error("Extracting archive...");
+      extractZipWindows(archivePath, tmpDir);
+    } else {
+      console.error("Extracting archive...");
+      execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], { stdio: "ignore" });
+    }
+
+    const binaryName = NAME + (isWindows ? ".exe" : "");
+    const extractedBinary = path.join(tmpDir, NAME + "-" + platform + "-" + arch);
+    if (fs.existsSync(extractedBinary)) {
+      fs.copyFileSync(extractedBinary, dest);
+    } else {
+      // Fallback: try the plain name (older release format)
+      const plainBinary = path.join(tmpDir, binaryName);
+      if (fs.existsSync(plainBinary)) {
+        fs.copyFileSync(plainBinary, dest);
+      } else {
+        // Search in tmpDir
+        const files = fs.readdirSync(tmpDir).filter(function(f) { return f.indexOf(NAME) !== -1 || f.indexOf(binaryName) !== -1; });
+        if (files.length > 0) {
+          fs.copyFileSync(path.join(tmpDir, files[0]), dest);
+        } else {
+          throw new Error("Binary not found in extracted archive. Files: " + fs.readdirSync(tmpDir).join(", "));
+        }
+      }
+    }
+    fs.chmodSync(dest, 0o755);
+    ensureExecutable(path.join(__dirname, "run.js"));
+    console.error("Installed to " + dest);
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
 function install() {
   fs.mkdirSync(binDir, { recursive: true });
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "delta-cli-"));
   var archivePath = path.join(tmpDir, archiveName);
 
-  releaseAssetUrls(VERSION, archiveName, function(downloadUrls) {
-    try {
+  // The packaged version first; the registry's latest is a fallback for a
+  // package whose version has no matching release.
+  var candidates = [VERSION];
+  var latest = registryLatestVersion();
+  if (latest && latest !== VERSION) candidates.push(latest);
+
+  var vi = 0;
+  function tryNextVersion() {
+    if (vi >= candidates.length) {
+      console.error("[FAIL] delta-cli could not be installed from any source");
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+      process.exit(1);
+    }
+    var version = candidates[vi++];
+    releaseAssetUrls(version, archiveName, function(downloadUrls) {
       var lastErr;
-      var downloaded = false;
       for (var i = 0; i < downloadUrls.length; i++) {
         try {
           console.error("Downloading from " + downloadUrls[i]);
           download(downloadUrls[i], archivePath);
           console.error("Download complete, verifying checksum...");
-          const expectedHash = getExpectedChecksum(archiveName);
+          const expectedHash = expectedChecksumFor(version, archiveName, tmpDir);
           verifyChecksum(archivePath, expectedHash);
           console.error("Checksum verified");
-          downloaded = true;
-          break;
+          extractAndInstall(tmpDir, archivePath);
+          return;
         } catch (e) {
           console.error("Failed: " + e.message + " (" + downloadUrls[i] + ")");
           lastErr = e;
         }
       }
-      if (!downloaded) throw lastErr;
-
-      if (isWindows) {
-        console.error("Extracting archive...");
-        extractZipWindows(archivePath, tmpDir);
-      } else {
-        console.error("Extracting archive...");
-        execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], { stdio: "ignore" });
-      }
+      console.error("Version v" + version + " could not be installed: " + (lastErr ? lastErr.message : "no source responded"));
+      tryNextVersion();
+    });
+  }
 
-      const binaryName = NAME + (isWindows ? ".exe" : "");
-      const extractedBinary = path.join(tmpDir, NAME + "-" + platform + "-" + arch);
-      if (fs.existsSync(extractedBinary)) {
-        fs.copyFileSync(extractedBinary, dest);
-      } else {
-        // Fallback: try the plain name (older release format)
-        const plainBinary = path.join(tmpDir, binaryName);
-        if (fs.existsSync(plainBinary)) {
-          fs.copyFileSync(plainBinary, dest);
-        } else {
-          // Search in tmpDir
-          const files = fs.readdirSync(tmpDir).filter(function(f) { return f.indexOf(NAME) !== -1 || f.indexOf(binaryName) !== -1; });
-          if (files.length > 0) {
-            fs.copyFileSync(path.join(tmpDir, files[0]), dest);
-          } else {
-            throw new Error("Binary not found in extracted archive. Files: " + fs.readdirSync(tmpDir).join(", "));
-          }
-        }
-      }
-      fs.chmodSync(dest, 0o755);
-      ensureExecutable(path.join(__dirname, "run.js"));
-      console.error("Installed to " + dest);
-    } finally {
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  });
+  tryNextVersion();
 }
 
 function ensureExecutable(filePath) {