@model-go/cli 0.1.3 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@model-go/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "The official CLI for modelgo. Pairs with AI agent skills so AI agents can operate modelgo on your behalf.",
   "bin": {
     "modelgo": "scripts/run.js"
@@ -17,7 +17,6 @@
     "scripts/install.js",
     "scripts/install-wizard.js",
     "scripts/run.js",
-    "checksums.txt",
     "LICENSE",
     "README.md"
   ],

package/scripts/install.js

@@ -31,6 +31,13 @@ const ext = isWindows ? ".zip" : ".tar.gz";
 const archiveName = `${NAME}-${VERSION}-${platform}-${arch}${ext}`;
 const GITHUB_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
 
+// checksums.txt is published by goreleaser alongside the release artifacts.
+// We fetch it from the release at install time rather than bundling it in the
+// npm package: a bundled copy generated locally (goreleaser --snapshot) can
+// never match the CI-built release artifacts' names or SHAs.
+const CHECKSUMS_NAME = "checksums.txt";
+const GITHUB_CHECKSUMS_URL = `https://github.com/${REPO}/releases/download/v${VERSION}/${CHECKSUMS_NAME}`;
+
 const binDir = path.join(__dirname, "..", "bin");
 const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
 
@@ -184,6 +191,21 @@ function download(url, destPath) {
   execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
 }
 
+// Try each URL in order, returning once one succeeds. Throws the last error if
+// all fail.
+function downloadFirst(urls, destPath) {
+  let lastErr;
+  for (const url of urls) {
+    try {
+      download(url, destPath);
+      return;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw lastErr;
+}
+
 function extractZipWindows(archivePath, destDir) {
   const psOpts = ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command"];
   const psStdio = ["ignore", "inherit", "inherit"];
@@ -228,20 +250,33 @@ function install() {
   const archivePath = path.join(tmpDir, archiveName);
 
   try {
-    let lastErr;
-    let downloaded = false;
-    for (const url of downloadUrls) {
-      try {
-        download(url, archivePath);
-        downloaded = true;
-        break;
-      } catch (e) {
-        lastErr = e;
-      }
+    downloadFirst(downloadUrls, archivePath);
+
+    // Fetch the authoritative checksums.txt from the same release (GitHub
+    // first, then mirrors). If it can't be fetched (restricted network),
+    // skip verification rather than block the install — the binary itself
+    // came from an allowlisted host over HTTPS.
+    const checksumsUrls = [
+      GITHUB_CHECKSUMS_URL,
+      ...resolveMirrorUrls(process.env, CHECKSUMS_NAME, VERSION),
+    ];
+    for (const u of checksumsUrls) ALLOWED_HOSTS.add(new URL(u).hostname);
+    const checksumsPath = path.join(tmpDir, CHECKSUMS_NAME);
+    let checksumsFetched = true;
+    try {
+      downloadFirst(checksumsUrls, checksumsPath);
+    } catch (e) {
+      checksumsFetched = false;
+      console.error(
+        `[WARN] could not fetch ${CHECKSUMS_NAME} from release ` +
+        `(${e.message}); skipping checksum verification`
+      );
     }
-    if (!downloaded) throw lastErr;
-
-    const expectedHash = getExpectedChecksum(archiveName);
+    // A fetched-but-incomplete checksums.txt is a real integrity problem and
+    // must fail loudly, so parse outside the network try/catch above.
+    const expectedHash = checksumsFetched
+      ? getExpectedChecksum(archiveName, tmpDir)
+      : null;
     verifyChecksum(archivePath, expectedHash);
 
     if (isWindows) {

package/checksums.txt

@@ -1,6 +0,0 @@
-d2301f86bdccb4225e959062382d20108eaac2ce023456f306485b8addcacacc  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-darwin-amd64.tar.gz
-88480f50f971139c72866d73a69a67368a08a260c96b71e04add4eb7d6676ecf  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-darwin-arm64.tar.gz
-9bc1719a182e3b996a793491775fd501da419a6c526d2b8a7cb2e72479cd9e1c  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-linux-amd64.tar.gz
-534554cb7b7fff278260b4e030fcbe30a0029c146d46980493a1d902e65c7669  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-linux-arm64.tar.gz
-13cfa7761480b595fab0e1c3400c299013d29eaca3643282f2817b872b7d89d1  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-windows-amd64.zip
-3d57522bf6cfaeaded3ea3b6db4cf4afd8ddd4f0fbf0bcea71241531898a939c  modelgo-0.1.2-rc.1-SNAPSHOT-7701312-windows-arm64.zip