@opencoven/coven-code 0.0.12 → 0.0.13

package/bin/coven-code

@@ -7,12 +7,12 @@ const os = require('os');
 const fs = require('fs');
 
 const ext = os.platform() === 'win32' ? '.exe' : '';
-const binary = path.join(__dirname, '..', 'native', `coven-code`);
+const binary = path.join(__dirname, '..', 'native', `coven-code${ext}`);
 
 if (!fs.existsSync(binary)) {
   console.error(
     'coven-code: native binary not found.\n' +
-    'Try reinstalling: npm install -g /coven-code\n' +
+    'Try reinstalling: npm install -g @opencoven/coven-code\n' +
     `Expected: ${binary}`
   );
   process.exit(1);

package/checksums.json

@@ -0,0 +1,17 @@
+{
+  "coven-code-windows-x86_64.zip": {
+    "sha256": "72745630211c6921018a779df724c99637af73e84168ffe851758c61bf680bdd"
+  },
+  "coven-code-linux-x86_64.tar.gz": {
+    "sha256": "223c1eedaad620af6df5ae776164f4b6d905ab28b55e07bc258601f5841bd366"
+  },
+  "coven-code-linux-aarch64.tar.gz": {
+    "sha256": "221eae094f6edb6d28ccdcc5bda90cf1c89e24d3a677bb4f7de51d8f1eff062f"
+  },
+  "coven-code-macos-x86_64.tar.gz": {
+    "sha256": "fd0ee2c2c605142198c48aa9c15adf6b7ee979aa47ef8b3f55edacb32251217d"
+  },
+  "coven-code-macos-aarch64.tar.gz": {
+    "sha256": "8b78b0475f32a233dab7a650f574ebd2f31a308fdcf79548697ebbb3107e3269"
+  }
+}

package/install.js

@@ -2,13 +2,14 @@
 'use strict';
 
 const https = require('https');
-const http = require('http');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 
 const pkg = require('./package.json');
+const checksums = require('./checksums.json');
 const VERSION = pkg.version;
 const REPO = 'OpenCoven/coven-code';
 const BASE_URL = `https://github.com/${REPO}/releases/download/v${VERSION}`;
@@ -41,13 +42,29 @@ function getPlatform() {
 
 function download(url, dest) {
   return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'https:') {
+      reject(new Error(`Refusing to download non-HTTPS URL: ${url}`));
+      return;
+    }
+
     const file = fs.createWriteStream(dest);
-    const get = url.startsWith('https') ? https : http;
-    get.get(url, (res) => {
-      if (res.statusCode === 301 || res.statusCode === 302) {
+    https.get(url, (res) => {
+      if ([301, 302, 303, 307, 308].includes(res.statusCode)) {
         file.close();
         try { fs.unlinkSync(dest); } catch (_) {}
-        download(res.headers.location, dest).then(resolve).catch(reject);
+        if (!res.headers.location) {
+          reject(new Error(`Redirect without Location header downloading ${url}`));
+          return;
+        }
+        let location;
+        try {
+          location = new URL(res.headers.location, url).toString();
+        } catch (err) {
+          reject(err);
+          return;
+        }
+        download(location, dest).then(resolve).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -69,6 +86,31 @@ function download(url, dest) {
   });
 }
 
+function sha256File(filePath) {
+  const hash = crypto.createHash('sha256');
+  const bytes = fs.readFileSync(filePath);
+  hash.update(bytes);
+  return hash.digest('hex');
+}
+
+function expectedSha256(archiveName) {
+  const entry = checksums[archiveName];
+  if (!entry || typeof entry.sha256 !== 'string') {
+    throw new Error(`Missing SHA-256 checksum for ${archiveName} in checksums.json`);
+  }
+  return entry.sha256;
+}
+
+function verifyChecksum(filePath, archiveName) {
+  const expected = expectedSha256(archiveName).toLowerCase();
+  const actual = sha256File(filePath).toLowerCase();
+  if (actual !== expected) {
+    throw new Error(
+      `Checksum mismatch for ${archiveName}: expected ${expected}, got ${actual}`
+    );
+  }
+}
+
 async function main() {
   const { artifact, ext, archive } = getPlatform();
   const archiveName = `${artifact}${archive}`;
@@ -87,6 +129,9 @@ async function main() {
   console.log(`            ${url}`);
   await download(url, tmpPath);
 
+  console.log('coven-code: verifying checksum...');
+  verifyChecksum(tmpPath, archiveName);
+
   console.log('coven-code: extracting...');
   if (archive === '.zip') {
     execFileSync('powershell', [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencoven/coven-code",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "description": "Open-source, multi-provider agentic coding TUI for the terminal — OpenCoven fork of Claurst",
   "license": "GPL-3.0-only",
   "repository": {
@@ -31,6 +31,7 @@
   "files": [
     "bin/",
     "install.js",
+    "checksums.json",
     "README.md",
     "ATTRIBUTION.md"
   ],