@lumi-ai-lab/harness-data 0.0.1 → 0.0.2

package/README.md

@@ -2,8 +2,15 @@
 
 ```bash
 npx @lumi-ai-lab/harness-data install
+npx @lumi-ai-lab/harness-data install --git-protocol ssh
+npx @lumi-ai-lab/harness-data install --git-protocol https
+GITHUB_TOKEN=... npx @lumi-ai-lab/harness-data install --yes --agent codex --git-protocol https --github-token-env GITHUB_TOKEN --cas-config-dir /secure/path/to/cas
 npx @lumi-ai-lab/harness-data doctor --dir ~/harness-data
 npx @lumi-ai-lab/harness-data update --dir ~/harness-data
 ```
 
 This package is only the installer and updater. The full Harness Data workspace is cloned and maintained outside the npm package.
+
+Private GitHub repository access defaults to `--git-protocol auto`: SSH is tried first, then HTTPS. HTTPS uses Git Credential Manager, `gh auth login`, or a token supplied through `--github-token-env`; GitHub account passwords are not supported.
+
+The `qdm-cmr-cli`, `qdm-indicators-cli`, and `cas-cli` binaries are downloaded from private GitHub Releases in `pengmide/qdm-cmr-cli`, `pengmide/qdm-indicators-cli`, and `pengmide/qdm-cas-cli`. The installer uses `gh auth login` first and falls back to `--github-token-env`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi-ai-lab/harness-data",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Installer and updater for Harness Data",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -39,6 +39,10 @@ Commands:
   install  Clone/reuse a Harness Data workspace and complete setup
   update   Check and apply installer, repository, CLI, and wikis updates
   doctor   Diagnose workspace CLI, config, auth, index, and Agent hooks
-  version  Print installer, repository, wikis, and manifest versions`);
+  version  Print installer, repository, wikis, and manifest versions
+
+Install options:
+  --git-protocol auto|ssh|https      Git protocol for private repositories (default: auto)
+  --github-token-env NAME            Token env var for HTTPS fallback or CI`);
   if (unknown) process.exitCode = 1;
 }

package/src/commands/install.js

@@ -10,8 +10,7 @@ import { platformKey } from "../lib/platform.js";
 import { collectDoctor } from "./doctor.js";
 import { checkUpdates } from "./update.js";
 import { packageVersion } from "../lib/package.js";
-
-const defaultRepo = "https://github.com/lumi-ai-lab/harness-data.git";
+import { gitUrls, repoProtocol, repoUrl, resolveInstallProtocol, runGitWithProtocol, syncWikisSubmodule } from "../lib/git-auth.js";
 
 async function requireCommands(commands) {
   for (const command of commands) {
@@ -21,19 +20,22 @@ async function requireCommands(commands) {
 
 async function prepareWorkspace(options) {
   const target = resolveWorkspaceDir(options.dir || (looksLikeWorkspace(process.cwd()) ? process.cwd() : defaultWorkspaceDir()));
-  const repo = options.repo || defaultRepo;
   const branch = options.branch || "master";
   if (!fs.existsSync(target)) {
+    const protocol = await resolveInstallProtocol(options);
+    const repo = options.repo || gitUrls[protocol].repo;
     if (!(await confirm(`Clone ${repo} to ${target}?`, { yes: options.yes }))) throw new Error("install cancelled");
     fs.mkdirSync(path.dirname(target), { recursive: true });
-    await run("git", ["clone", "--recurse-submodules", "--branch", branch, repo, target], { stdio: "inherit" });
-    return target;
+    await runGitWithProtocol(protocol, ["clone", "--branch", branch, repo, target], { ...options, stdio: "inherit" });
+    await syncWikisSubmodule(target, protocol);
+    await runGitWithProtocol(protocol, ["submodule", "update", "--init", "--recursive", "wikis"], { ...options, cwd: target, stdio: "inherit" });
+    return { workspace: target, gitProtocol: protocol, repoUrl: repo };
   }
   if (!(await isGitRepo(target)) || !looksLikeWorkspace(target)) {
     throw new Error(`${target} exists but is not a valid harness-data workspace; pass --dir or move the directory`);
   }
   if (!(await confirm(`Reuse existing workspace ${target}?`, { yes: options.yes }))) throw new Error("install cancelled");
-  return target;
+  return { workspace: target, gitProtocol: await repoProtocol(target), repoUrl: await repoUrl(target) };
 }
 
 async function configureAuth(workspace, options) {
@@ -82,10 +84,11 @@ async function buildAndCheck(workspace, options) {
 export async function installCommand(options = {}) {
   platformKey();
   await requireCommands(["git", "curl", "tar", "unzip"]);
-  const workspace = await prepareWorkspace(options);
+  const prepared = await prepareWorkspace(options);
+  const workspace = prepared.workspace;
   const manifestPath = path.resolve(options.manifest || path.join(workspace, "bootstrap", "cli-manifest.json"));
   if (!(await confirm("Download or refresh CLI binaries?", { yes: options.yes }))) throw new Error("install cancelled");
-  const manifest = await installToolsFromManifest(workspace, manifestPath);
+  const manifest = await installToolsFromManifest(workspace, manifestPath, options);
   const configExists = fs.existsSync(path.join(workspace, "config", "harness-config.yaml")) ||
     fs.existsSync(path.join(workspace, "config", "qdm-cli-paths.env"));
   const overwrite = configExists && !options.yes ? await confirm("Overwrite existing local config files?", { defaultNo: true }) : !configExists;
@@ -101,7 +104,8 @@ export async function installCommand(options = {}) {
   const doctor = await collectDoctor(workspace, { ...options, casConfigDir });
   for (const check of doctor.checks) console.log(`${check.ok ? "PASS" : "FAIL"} ${check.name}`);
   if (doctor.checks.some((check) => !check.ok)) throw new Error("doctor failed; install is incomplete");
-  const updates = await checkUpdates(workspace);
+  const gitProtocol = prepared.gitProtocol || await repoProtocol(workspace) || "ssh";
+  const updates = await checkUpdates(workspace, { ...options, gitProtocol });
   if (updates.hasUpdates) {
     console.log(`Updates available. Next step: npx @lumi-ai-lab/harness-data update --dir "${workspace}"`);
   }
@@ -110,7 +114,9 @@ export async function installCommand(options = {}) {
     wikisCommit: await submoduleCommit(workspace),
     manifestSha256: manifestDigest(manifest),
     lastCheckAt: new Date().toISOString(),
-    packageVersion: packageVersion()
+    packageVersion: packageVersion(),
+    gitProtocol,
+    repoUrl: prepared.repoUrl
   });
   console.log(`Harness Data installed: ${workspace}`);
 }

package/src/commands/update.js

@@ -7,6 +7,7 @@ import { installToolsFromManifest, manifestDigest, readManifest } from "../lib/m
 import { behindCount, currentCommit, dirtyPaths, submoduleCommit, submodulePointerChanged, submoduleRemoteBehind } from "../lib/git.js";
 import { packageVersion } from "../lib/package.js";
 import { collectDoctor } from "./doctor.js";
+import { normalizeGitProtocol, repoProtocol, repoUrl, runGitWithProtocol, syncWikisSubmodule } from "../lib/git-auth.js";
 
 async function npmLatest() {
   try {
@@ -35,12 +36,12 @@ function versionChanged(current, latest) {
   return latest && latest !== current;
 }
 
-export async function checkUpdates(workspace) {
+export async function checkUpdates(workspace, gitOptions = {}) {
   const manifestPath = path.join(workspace, "bootstrap", "cli-manifest.json");
   const currentInstaller = packageVersion();
   const latestInstaller = await npmLatest();
-  const mainBehind = await behindCount(workspace);
-  const wikisBehind = await submoduleRemoteBehind(workspace);
+  const mainBehind = await behindCount(workspace, gitOptions);
+  const wikisBehind = await submoduleRemoteBehind(workspace, "wikis", gitOptions);
   const manifest = fs.existsSync(manifestPath) ? readManifest(manifestPath) : { tools: [] };
   const digest = manifestDigest(manifest);
   const remote = await remoteManifest(workspace);
@@ -78,6 +79,13 @@ function printUpdateSummary(updates) {
   }
 }
 
+async function updateProtocol(workspace, options) {
+  const requested = normalizeGitProtocol(options.gitProtocol);
+  if (requested !== "auto") return requested;
+  const state = readUserState();
+  return state.gitProtocol || await repoProtocol(workspace) || "ssh";
+}
+
 export async function updateCommand(options = {}) {
   const workspace = findWorkspaceDir(options.dir);
   if (!fs.existsSync(workspace)) throw new Error(`workspace does not exist: ${workspace}`);
@@ -90,7 +98,10 @@ export async function updateCommand(options = {}) {
     process.exitCode = 1;
     return;
   }
-  const updates = await checkUpdates(workspace);
+  const gitProtocol = await updateProtocol(workspace, options);
+  await syncWikisSubmodule(workspace, gitProtocol);
+  const originUrl = await repoUrl(workspace);
+  const updates = await checkUpdates(workspace, { ...options, gitProtocol });
   printUpdateSummary(updates);
   if (options.check) {
     writeState(workspace, {
@@ -98,7 +109,9 @@ export async function updateCommand(options = {}) {
       wikisCommit: await submoduleCommit(workspace),
       manifestSha256: updates.cli.digest,
       packageVersion: packageVersion(),
-      lastCheckAt: new Date().toISOString()
+      lastCheckAt: new Date().toISOString(),
+      gitProtocol,
+      repoUrl: originUrl
     });
     return updates;
   }
@@ -109,22 +122,25 @@ export async function updateCommand(options = {}) {
       wikisCommit: await submoduleCommit(workspace),
       manifestSha256: updates.cli.digest,
       packageVersion: packageVersion(),
-      lastCheckAt: new Date().toISOString()
+      lastCheckAt: new Date().toISOString(),
+      gitProtocol,
+      repoUrl: originUrl
     });
     return updates;
   }
   if (!(await confirm(`Apply updates to ${workspace}?`, { yes: options.yes, defaultNo: true }))) throw new Error("update cancelled");
   if (updates.mainRepo.update) {
-    await run("git", ["pull", "--ff-only"], { cwd: workspace, stdio: "inherit" });
+    await runGitWithProtocol(gitProtocol, ["pull", "--ff-only"], { ...options, cwd: workspace, stdio: "inherit" });
   }
   if (updates.wikis.update || updates.mainRepo.update) {
     if (!(await confirm("Update wikis submodule? This can change Agent behavior.", { yes: options.yes, defaultNo: true }))) {
       console.warn("warning: wikis update skipped");
     } else {
-      await run("git", ["submodule", "update", "--init", "--recursive", "--remote", "wikis"], { cwd: workspace, stdio: "inherit" });
+      await syncWikisSubmodule(workspace, gitProtocol);
+      await runGitWithProtocol(gitProtocol, ["submodule", "update", "--init", "--recursive", "--remote", "wikis"], { ...options, cwd: workspace, stdio: "inherit" });
     }
   }
-  await installToolsFromManifest(workspace, path.join(workspace, "bootstrap", "cli-manifest.json"));
+  await installToolsFromManifest(workspace, path.join(workspace, "bootstrap", "cli-manifest.json"), options);
   await run(path.join(workspace, "bin", "data-harness-cli"), ["wikis", "build-index"], { cwd: workspace, stdio: "inherit" });
   const doctor = await collectDoctor(workspace, options);
   for (const check of doctor.checks) console.log(`${check.ok ? "PASS" : "FAIL"} ${check.name}`);
@@ -134,7 +150,9 @@ export async function updateCommand(options = {}) {
     wikisCommit: await submoduleCommit(workspace),
     manifestSha256: updates.cli.digest,
     packageVersion: packageVersion(),
-    lastCheckAt: new Date().toISOString()
+    lastCheckAt: new Date().toISOString(),
+    gitProtocol,
+    repoUrl: originUrl
   });
   console.log(`Harness Data updated: ${workspace}`);
 }

package/src/lib/git-auth.js

@@ -0,0 +1,117 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { run } from "./exec.js";
+
+export const gitUrls = {
+  ssh: {
+    repo: "git@github.com:lumi-ai-lab/harness-data.git",
+    wikis: "git@github.com:lumi-ai-lab/harness-data-wikis.git"
+  },
+  https: {
+    repo: "https://github.com/lumi-ai-lab/harness-data.git",
+    wikis: "https://github.com/lumi-ai-lab/harness-data-wikis.git"
+  }
+};
+
+const protocols = new Set(["auto", "ssh", "https"]);
+
+export function normalizeGitProtocol(value = "auto") {
+  if (!protocols.has(value)) throw new Error("--git-protocol must be one of: auto, ssh, https");
+  return value;
+}
+
+export function protocolFromUrl(url = "") {
+  if (url.startsWith("git@") || url.startsWith("ssh://")) return "ssh";
+  if (url.startsWith("https://")) return "https";
+  return "";
+}
+
+export async function repoUrl(workspace) {
+  const result = await run("git", ["remote", "get-url", "origin"], { cwd: workspace, allowFailure: true });
+  return result.stdout.trim();
+}
+
+export async function repoProtocol(workspace) {
+  return protocolFromUrl(await repoUrl(workspace));
+}
+
+function httpsFailureMessage() {
+  return [
+    "HTTPS access to the private GitHub repositories failed.",
+    "Fix by configuring a GitHub SSH key, running gh auth login, enabling Git Credential Manager,",
+    "or passing --github-token-env GITHUB_TOKEN with a token stored in that environment variable."
+  ].join(" ");
+}
+
+function tokenEnvName(options = {}) {
+  const name = options.githubTokenEnv;
+  if (!name) return "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error("--github-token-env must be a valid environment variable name");
+  if (!process.env[name]) throw new Error(`environment variable ${name} is empty or unset`);
+  return name;
+}
+
+async function withHttpsAuthEnv(options, callback) {
+  const name = tokenEnvName(options);
+  if (!name) return callback({ GIT_TERMINAL_PROMPT: "0" });
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "harness-data-git-"));
+  const askpass = path.join(dir, "askpass.sh");
+  fs.writeFileSync(askpass, [
+    "#!/bin/sh",
+    "case \"$1\" in",
+    "*Username*) printf '%s\\n' x-access-token ;;",
+    "*Password*) printenv \"$GITHUB_TOKEN_ENV_NAME\" ;;",
+    "*) printf '\\n' ;;",
+    "esac",
+    ""
+  ].join("\n"), { mode: 0o700 });
+
+  try {
+    return await callback({
+      GIT_ASKPASS: askpass,
+      GITHUB_TOKEN_ENV_NAME: name,
+      GIT_TERMINAL_PROMPT: "0"
+    });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+export async function runGitWithProtocol(protocol, commandArgs, options = {}) {
+  if (protocol === "https") {
+    return withHttpsAuthEnv(options, (env) => run("git", commandArgs, { ...options, env: { ...(options.env || {}), ...env } }));
+  }
+  const env = {
+    ...(options.env || {}),
+    GIT_SSH_COMMAND: "ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
+  };
+  return run("git", commandArgs, { ...options, env });
+}
+
+async function canAccess(protocol, url, options) {
+  const result = await runGitWithProtocol(protocol, ["ls-remote", url, "HEAD"], { ...options, allowFailure: true });
+  return result.code === 0;
+}
+
+export async function resolveInstallProtocol(options = {}) {
+  const requested = normalizeGitProtocol(options.gitProtocol);
+  if (requested === "ssh") {
+    if (await canAccess("ssh", gitUrls.ssh.wikis, options)) return "ssh";
+    throw new Error("SSH access to the private GitHub repositories failed. Configure a GitHub SSH key or retry with --git-protocol https.");
+  }
+  if (requested === "https") {
+    if (await canAccess("https", gitUrls.https.wikis, options)) return "https";
+    throw new Error(httpsFailureMessage());
+  }
+  if (await canAccess("ssh", gitUrls.ssh.wikis, options)) return "ssh";
+  console.warn("SSH unavailable, falling back to HTTPS");
+  if (await canAccess("https", gitUrls.https.wikis, options)) return "https";
+  throw new Error(httpsFailureMessage());
+}
+
+export async function syncWikisSubmodule(workspace, protocol, options = {}) {
+  await run("git", ["config", "submodule.wikis.url", gitUrls[protocol].wikis], { cwd: workspace, stdio: options.stdio || "inherit" });
+  await run("git", ["submodule", "sync", "wikis"], { cwd: workspace, stdio: options.stdio || "inherit" });
+}

package/src/lib/git.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { run } from "./exec.js";
+import { runGitWithProtocol } from "./git-auth.js";
 
 export async function isGitRepo(dir) {
   if (!fs.existsSync(path.join(dir, ".git"))) return false;
@@ -33,10 +34,18 @@ export async function remoteTracking(dir) {
   return result.code === 0 ? result.stdout.trim() : "";
 }
 
-export async function behindCount(dir) {
+async function fetchQuiet(dir, options = {}) {
+  if (options.gitProtocol) {
+    await runGitWithProtocol(options.gitProtocol, ["fetch", "--quiet"], { ...options, cwd: dir, allowFailure: true });
+    return;
+  }
+  await run("git", ["fetch", "--quiet"], { cwd: dir, allowFailure: true });
+}
+
+export async function behindCount(dir, options = {}) {
   const upstream = await remoteTracking(dir);
   if (!upstream) return 0;
-  await run("git", ["fetch", "--quiet"], { cwd: dir, allowFailure: true });
+  await fetchQuiet(dir, options);
   const result = await run("git", ["rev-list", "--count", `HEAD..${upstream}`], { cwd: dir, allowFailure: true });
   return Number(result.stdout.trim() || "0");
 }
@@ -46,10 +55,10 @@ export async function submoduleCommit(dir, name = "wikis") {
   return result.code === 0 ? result.stdout.trim() : "";
 }
 
-export async function submoduleRemoteBehind(dir, name = "wikis") {
+export async function submoduleRemoteBehind(dir, name = "wikis", options = {}) {
   const subdir = path.join(dir, name);
   if (!fs.existsSync(subdir)) return 0;
-  await run("git", ["fetch", "--quiet"], { cwd: subdir, allowFailure: true });
+  await fetchQuiet(subdir, options);
   const upstream = await remoteTracking(subdir);
   if (!upstream) return 0;
   const result = await run("git", ["rev-list", "--count", `HEAD..${upstream}`], { cwd: subdir, allowFailure: true });

package/src/lib/manifest.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import https from "node:https";
 import path from "node:path";
-import { run } from "./exec.js";
+import { commandExists, run } from "./exec.js";
 import { platformKey } from "./platform.js";
 
 export function readManifest(file) {
@@ -13,11 +13,14 @@ export function manifestDigest(manifest) {
   return crypto.createHash("sha256").update(JSON.stringify(manifest)).digest("hex");
 }
 
-function download(url, file) {
+function download(url, file, headers = {}) {
   return new Promise((resolve, reject) => {
-    const request = https.get(url, (response) => {
+    const request = https.get(url, { headers }, (response) => {
       if ([301, 302, 307, 308].includes(response.statusCode) && response.headers.location) {
-        download(response.headers.location, file).then(resolve, reject);
+        const current = new URL(url);
+        const next = new URL(response.headers.location, url);
+        const nextHeaders = current.hostname === next.hostname ? headers : {};
+        download(response.headers.location, file, nextHeaders).then(resolve, reject);
         return;
       }
       if (response.statusCode !== 200) {
@@ -35,11 +38,97 @@ function download(url, file) {
   });
 }
 
-async function expectedSha256(asset) {
+function assetName(asset) {
+  return path.basename(new URL(asset.url).pathname);
+}
+
+function githubAssetParts(asset) {
+  const url = new URL(asset.url);
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (url.hostname !== "github.com" || parts.length < 6 || parts[2] !== "releases" || parts[3] !== "download") return null;
+  return {
+    repo: `${parts[0]}/${parts[1]}`,
+    tag: parts[4],
+    name: parts.slice(5).join("/")
+  };
+}
+
+async function ghAuthenticated() {
+  if (!(await commandExists("gh"))) return false;
+  const result = await run("gh", ["auth", "status"], { allowFailure: true });
+  return result.code === 0;
+}
+
+async function downloadPrivateWithGh(asset, file) {
+  const parts = githubAssetParts(asset);
+  if (!parts || !(await ghAuthenticated())) return false;
+  const dir = fs.mkdtempSync(path.join(path.dirname(file), "gh-download-"));
+  try {
+    const result = await run("gh", ["release", "download", parts.tag, "--repo", parts.repo, "--pattern", parts.name, "--dir", dir], { allowFailure: true });
+    if (result.code !== 0) return false;
+    const downloaded = path.join(dir, parts.name);
+    if (!fs.existsSync(downloaded)) return false;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.renameSync(downloaded, file);
+    return true;
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function githubToken(options = {}) {
+  const name = options.githubTokenEnv;
+  if (!name) return "";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error("--github-token-env must be a valid environment variable name");
+  return process.env[name] || "";
+}
+
+async function githubAssetApiUrl(asset, token) {
+  const parts = githubAssetParts(asset);
+  if (!parts) return "";
+  const dir = fs.mkdtempSync(path.join(process.cwd(), ".bootstrap-cache-gh-"));
+  const tmp = path.join(dir, "release.json");
+  try {
+    await download(`https://api.github.com/repos/${parts.repo}/releases/tags/${parts.tag}`, tmp, {
+      Authorization: `Bearer ${token}`,
+      "User-Agent": "harness-data-installer"
+    });
+    const release = JSON.parse(fs.readFileSync(tmp, "utf8"));
+    return (release.assets || []).find((item) => item.name === parts.name)?.url || "";
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function downloadPrivateWithToken(asset, file, options = {}) {
+  const token = githubToken(options);
+  if (!token) return false;
+  const apiUrl = await githubAssetApiUrl(asset, token);
+  if (!apiUrl) return false;
+  await download(apiUrl, file, {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/octet-stream",
+    "User-Agent": "harness-data-installer"
+  });
+  return true;
+}
+
+async function downloadAsset(tool, asset, file, options = {}) {
+  if (!tool.private) {
+    await download(asset.url, file);
+    return;
+  }
+  console.log(`Downloading private ${tool.name} asset from ${tool.repo}`);
+  if (await downloadPrivateWithGh(asset, file)) return;
+  if (await downloadPrivateWithToken(asset, file, options)) return;
+  throw new Error(`private GitHub Release asset requires gh auth login or --github-token-env GITHUB_TOKEN: ${assetName(asset)}`);
+}
+
+async function expectedSha256(tool, asset, options = {}) {
   if (asset.sha256) return asset.sha256;
   try {
     const tmp = path.join(fs.mkdtempSync(path.join(process.cwd(), ".bootstrap-cache-sha-")), "asset.sha256");
-    await download(`${asset.url}.sha256`, tmp);
+    await downloadAsset(tool, { ...asset, url: `${asset.url}.sha256` }, tmp, options);
     return fs.readFileSync(tmp, "utf8").trim().split(/\s+/)[0];
   } catch {
     return "";
@@ -50,7 +139,7 @@ function fileSha256(file) {
   return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 }
 
-export async function installToolsFromManifest(workspace, manifestPath) {
+export async function installToolsFromManifest(workspace, manifestPath, options = {}) {
   const manifest = readManifest(manifestPath);
   const key = platformKey();
   const cacheDir = path.join(workspace, ".bootstrap-cache");
@@ -61,10 +150,10 @@ export async function installToolsFromManifest(workspace, manifestPath) {
   for (const tool of manifest.tools || []) {
     const asset = tool.platforms?.[key];
     if (!asset?.url) throw new Error(`manifest missing ${tool.name} asset for ${key}`);
-    const archive = path.join(cacheDir, path.basename(new URL(asset.url).pathname));
+    const archive = path.join(cacheDir, assetName(asset));
     console.log(`Downloading ${tool.name} ${tool.version} (${key})`);
-    await download(asset.url, archive);
-    const sha = await expectedSha256(asset);
+    await downloadAsset(tool, asset, archive, options);
+    const sha = await expectedSha256(tool, asset, options);
     if (sha && fileSha256(archive) !== sha) throw new Error(`${tool.name} sha256 mismatch`);
     if (!sha) console.warn(`warning: ${tool.name} has no sha256; continuing without checksum`);
     if (archive.endsWith(".zip")) {