@dhruv2mars/mdv 0.0.8 → 0.0.10

package/bin/install-lib.js

@@ -3,26 +3,80 @@ export function assetNameFor(platform = process.platform, arch = process.arch) {
   return `mdv-${platform}-${arch}${ext}`;
 }
 
+export function checksumsAssetNameFor(platform = process.platform, arch = process.arch) {
+  return `checksums-${platform}-${arch}.txt`;
+}
+
+export function checksumsAssetNameFromBinaryAsset(asset) {
+  if (typeof asset !== 'string') return null;
+  const m = asset.match(/^mdv-([a-z0-9]+)-([a-z0-9_]+)(?:\.exe)?$/i);
+  if (!m) return null;
+  return checksumsAssetNameFor(m[1], m[2]);
+}
+
 export function findAssetUrl(release, asset) {
   if (!release || !Array.isArray(release.assets)) return null;
-  const match = release.assets.find((item) => item?.name === asset);
-  if (!match) return null;
-  return match.browser_download_url || null;
+  for (const item of release.assets) {
+    if (item?.name !== asset) continue;
+    if (typeof item.browser_download_url === 'string' && item.browser_download_url.length > 0) {
+      return item.browser_download_url;
+    }
+  }
+  return null;
 }
 
-export async function resolveReleaseAssetUrl({ version, asset, getRelease }) {
-  const tag = `tags/v${version}`;
-  try {
-    const tagged = await getRelease(tag);
-    const taggedUrl = findAssetUrl(tagged, asset);
-    if (taggedUrl) return taggedUrl;
-  } catch {}
+export function shouldUseFallbackUrl(primaryUrl, fallbackUrl) {
+  if (typeof fallbackUrl !== 'string' || fallbackUrl.length === 0) return false;
+  if (typeof primaryUrl !== 'string' || primaryUrl.length === 0) return true;
+  return fallbackUrl !== primaryUrl;
+}
 
-  try {
-    const latest = await getRelease('latest');
-    const latestUrl = findAssetUrl(latest, asset);
-    if (latestUrl) return latestUrl;
-  } catch {}
+export function parseChecksumForAsset(text, asset) {
+  if (typeof text !== 'string' || typeof asset !== 'string' || asset.length === 0) return null;
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.trim().match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (!m) continue;
+    if (m[2].trim() !== asset) continue;
+    return m[1].toLowerCase();
+  }
+  return null;
+}
+
+export async function resolveReleaseAssetBundle({ version, asset, checksumsAsset, getRelease }) {
+  const tagged = `tags/v${version}`;
+  const taggedBundle = await resolveReleaseAssetBundleFromKind({
+    kind: tagged,
+    asset,
+    checksumsAsset,
+    getRelease
+  });
+  if (taggedBundle) return taggedBundle;
+
+  const latestBundle = await resolveReleaseAssetBundleFromKind({
+    kind: 'latest',
+    asset,
+    checksumsAsset,
+    getRelease
+  });
+  if (latestBundle) return latestBundle;
 
   return null;
 }
+
+async function resolveReleaseAssetBundleFromKind({ kind, asset, checksumsAsset, getRelease }) {
+  try {
+    const release = await getRelease(kind);
+    const binaryUrl = findAssetUrl(release, asset);
+    const checksumsUrl = findAssetUrl(release, checksumsAsset);
+    if (!binaryUrl || !checksumsUrl) return null;
+    return { binaryUrl, checksumsUrl };
+  } catch {
+    return null;
+  }
+}
+
+export async function resolveReleaseAssetUrl({ version, asset, getRelease }) {
+  const checksumsAsset = checksumsAssetNameFromBinaryAsset(asset) || checksumsAssetNameFor();
+  const bundle = await resolveReleaseAssetBundle({ version, asset, checksumsAsset, getRelease });
+  return bundle?.binaryUrl || null;
+}

package/bin/install.js

@@ -4,17 +4,25 @@ import {
   copyFileSync,
   createWriteStream,
   existsSync,
+  createReadStream,
   mkdirSync,
   readFileSync,
   rmSync,
   renameSync
 } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import https from 'node:https';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { assetNameFor, resolveReleaseAssetUrl } from './install-lib.js';
+import {
+  assetNameFor,
+  checksumsAssetNameFor,
+  parseChecksumForAsset,
+  resolveReleaseAssetBundle,
+  shouldUseFallbackUrl
+} from './install-lib.js';
 
 const REPO = 'Dhruv2mars/mdv';
 
@@ -22,6 +30,9 @@ const installRoot = process.env.MDV_INSTALL_ROOT || join(homedir(), '.mdv');
 const binDir = join(installRoot, 'bin');
 const binName = process.platform === 'win32' ? 'mdv.exe' : 'mdv';
 const dest = join(binDir, binName);
+const retryAttempts = Number(process.env.MDV_INSTALL_RETRY_ATTEMPTS || 3);
+const timeoutMs = Number(process.env.MDV_INSTALL_TIMEOUT_MS || 15000);
+const backoffMs = Number(process.env.MDV_INSTALL_BACKOFF_MS || 250);
 
 if (process.env.MDV_SKIP_DOWNLOAD === '1') process.exit(0);
 if (existsSync(dest)) process.exit(0);
@@ -30,12 +41,20 @@ mkdirSync(binDir, { recursive: true });
 
 const version = pkgVersion();
 const asset = assetNameFor();
+const checksumsAsset = checksumsAssetNameFor();
 const url = `https://github.com/${REPO}/releases/download/v${version}/${asset}`;
+const checksumsUrl = `https://github.com/${REPO}/releases/download/v${version}/${checksumsAsset}`;
 const tmp = `${dest}.tmp-${Date.now()}`;
 
 try {
   console.error(`mdv: download ${asset} v${version}`);
-  await downloadWithFallback(url, version, asset, tmp);
+  await downloadWithFallback(
+    { binaryUrl: url, checksumsUrl },
+    version,
+    asset,
+    checksumsAsset,
+    tmp
+  );
   if (process.platform !== 'win32') chmodSync(tmp, 0o755);
   renameSync(tmp, dest);
   process.exit(0);
@@ -65,14 +84,23 @@ function pkgVersion() {
 }
 
 function download(url, outPath) {
+  return downloadWithRedirects(url, outPath, 0);
+}
+
+function downloadWithRedirects(url, outPath, redirects) {
   return new Promise((resolve, reject) => {
+    if (redirects > 5) {
+      reject(new Error('too many redirects'));
+      return;
+    }
+
     const req = https.get(
       url,
       { headers: { 'User-Agent': 'mdv-installer', Accept: 'application/octet-stream' } },
       (res) => {
         if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
           res.resume();
-          download(res.headers.location, outPath).then(resolve, reject);
+          downloadWithRedirects(res.headers.location, outPath, redirects + 1).then(resolve, reject);
           return;
         }
 
@@ -85,31 +113,116 @@ function download(url, outPath) {
         const file = createWriteStream(outPath);
         res.pipe(file);
         file.on('finish', () => file.close(resolve));
-        file.on('error', reject);
+        file.on('error', (err) => {
+          try {
+            rmSync(outPath, { force: true });
+          } catch {}
+          reject(err);
+        });
+      }
+    );
+
+    req.setTimeout(timeoutMs, () => {
+      req.destroy(new Error(`timeout ${timeoutMs}ms`));
+    });
+    req.on('error', reject);
+  });
+}
+
+function requestText(url) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(
+      url,
+      { headers: { 'User-Agent': 'mdv-installer', Accept: 'text/plain' } },
+      (res) => {
+        if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+          res.resume();
+          requestText(res.headers.location).then(resolve, reject);
+          return;
+        }
+        if (res.statusCode !== 200) {
+          res.resume();
+          reject(new Error(`http ${res.statusCode}`));
+          return;
+        }
+
+        let data = '';
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => {
+          data += chunk;
+        });
+        res.on('end', () => resolve(data));
       }
     );
 
+    req.setTimeout(timeoutMs, () => {
+      req.destroy(new Error(`timeout ${timeoutMs}ms`));
+    });
     req.on('error', reject);
   });
 }
 
-async function downloadWithFallback(primaryUrl, version, asset, outPath) {
+async function withRetry(label, fn) {
+  let lastErr = null;
+  for (let attempt = 1; attempt <= retryAttempts; attempt += 1) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (attempt >= retryAttempts) break;
+      await sleep(backoffMs * attempt);
+      console.error(`mdv: retry ${label} (${attempt + 1}/${retryAttempts})`);
+    }
+  }
+  throw lastErr || new Error(`retry failed: ${label}`);
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function sha256File(path) {
+  return new Promise((resolve, reject) => {
+    const hash = createHash('sha256');
+    const inStream = createReadStream(path);
+    inStream.on('error', reject);
+    inStream.on('data', (chunk) => hash.update(chunk));
+    inStream.on('end', () => resolve(hash.digest('hex')));
+  });
+}
+
+async function downloadAndVerify({ binaryUrl, checksumsUrl }, asset, outPath) {
+  await withRetry('binary', () => download(binaryUrl, outPath));
+  const checksumsText = await withRetry('checksums', () => requestText(checksumsUrl));
+  const expected = parseChecksumForAsset(checksumsText, asset);
+  if (!expected) {
+    throw new Error(`checksum missing for ${asset}`);
+  }
+
+  const actual = await sha256File(outPath);
+  if (actual !== expected) {
+    throw new Error(`checksum mismatch for ${asset}`);
+  }
+}
+
+async function downloadWithFallback(primary, version, asset, checksumsAsset, outPath) {
   try {
-    await download(primaryUrl, outPath);
+    await downloadAndVerify(primary, asset, outPath);
     return;
   } catch (primaryErr) {
-    const fallbackUrl = await resolveReleaseAssetUrl({
+    const fallback = await resolveReleaseAssetBundle({
       version,
       asset,
-      getRelease: getRelease
+      checksumsAsset,
+      getRelease: (kind) => withRetry(`release:${kind}`, () => getRelease(kind))
     });
 
-    if (!fallbackUrl || fallbackUrl === primaryUrl) {
+    if (!fallback || !shouldUseFallbackUrl(primary.binaryUrl, fallback.binaryUrl)) {
       throw primaryErr;
     }
 
-    console.error(`mdv: fallback download ${fallbackUrl}`);
-    await download(fallbackUrl, outPath);
+    console.error(`mdv: fallback download ${fallback.binaryUrl}`);
+    await downloadAndVerify(fallback, asset, outPath);
   }
 }
 
@@ -150,6 +263,9 @@ function requestJson(url) {
       });
     });
 
+    req.setTimeout(timeoutMs, () => {
+      req.destroy(new Error(`timeout ${timeoutMs}ms`));
+    });
     req.on('error', reject);
   });
 }

package/bin/selftest.js

@@ -1,16 +1,55 @@
 #!/usr/bin/env node
-import { mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 
 const root = mkdtempSync(join(tmpdir(), 'mdv-install-'));
 const env = { ...process.env, MDV_INSTALL_ROOT: root };
+const binName = process.platform === 'win32' ? 'mdv.exe' : 'mdv';
+const installedBin = join(root, 'bin', binName);
 
 const res = spawnSync(process.execPath, [new URL('./install.js', import.meta.url).pathname], {
-  stdio: 'inherit',
+  stdio: 'pipe',
+  encoding: 'utf8',
   env
 });
 
+if ((res.status ?? 1) !== 0) {
+  printDiag('installer exited non-zero', { root, status: res.status, stderr: res.stderr });
+  rmSync(root, { recursive: true, force: true });
+  process.exit(res.status ?? 1);
+}
+
+if (!existsSync(installedBin)) {
+  printDiag('installed binary missing after installer success', { root, expected: installedBin });
+  rmSync(root, { recursive: true, force: true });
+  process.exit(1);
+}
+
+const smoke = spawnSync(installedBin, ['--help'], {
+  stdio: 'pipe',
+  encoding: 'utf8',
+  env
+});
+if ((smoke.status ?? 1) !== 0) {
+  printDiag('installed binary failed --help', {
+    root,
+    expected: installedBin,
+    status: smoke.status,
+    stderr: smoke.stderr
+  });
+  rmSync(root, { recursive: true, force: true });
+  process.exit(smoke.status ?? 1);
+}
+
 rmSync(root, { recursive: true, force: true });
-process.exit(res.status ?? 1);
+process.exit(0);
+
+function printDiag(message, data) {
+  console.error(`mdv selftest: ${message}`);
+  for (const [k, v] of Object.entries(data)) {
+    if (!v) continue;
+    console.error(`mdv selftest: ${k}=${String(v).trim()}`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dhruv2mars/mdv",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Terminal-first markdown visualizer/editor",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "selftest": "node bin/selftest.js",
     "lint": "node --check bin/mdv.js && node --check bin/install.js && node --check bin/install-lib.js && node --check bin/selftest.js",
     "test": "node scripts/test.js",
-    "coverage": "c8 --all --include bin/install-lib.js --reporter text-summary --check-coverage --lines 100 --functions 100 --branches 80 --statements 100 node scripts/test.js"
+    "coverage": "c8 --all --include bin/install-lib.js --reporter text-summary --check-coverage --lines 95 --functions 95 --branches 80 --statements 95 node scripts/test.js"
   },
   "keywords": [
     "markdown",