@pandanpc/mcp-server 0.1.23 → 0.1.25

package/binary-name.js

@@ -0,0 +1,8 @@
+const pkg = require('./package.json')
+
+function binaryName(platform = process.platform, version = pkg.version) {
+  const extension = platform === 'win32' ? '.exe' : ''
+  return `pandanpc-mcp-v${version}${extension}`
+}
+
+module.exports = { binaryName }

package/index.js

@@ -7,8 +7,9 @@
 const path = require('path')
 const { spawn } = require('child_process')
 const fs = require('fs')
+const { binaryName } = require('./binary-name')
 
-const binName = process.platform === 'win32' ? 'pandanpc-mcp.exe' : 'pandanpc-mcp'
+const binName = binaryName()
 const binPath = path.join(__dirname, 'bin', binName)
 
 if (!fs.existsSync(binPath)) {

package/install.js

@@ -10,6 +10,7 @@ const fs = require('fs')
 const path = require('path')
 const https = require('https')
 const crypto = require('crypto')
+const { binaryName } = require('./binary-name')
 
 const pkg = require('./package.json')
 const VERSION = pkg.version
@@ -66,6 +67,18 @@ function sha256(file) {
   })
 }
 
+function checksumFor(sumsText, artifactName) {
+  const line = String(sumsText || '')
+    .split('\n')
+    .map((entry) => entry.trim().split(/\s+/))
+    .find((entry) => entry[1] === artifactName)
+  const checksum = line?.[0]?.toLowerCase() || ''
+  if (!/^[a-f0-9]{64}$/.test(checksum)) {
+    throw new Error(`SHA256SUMS has no valid checksum for ${artifactName}`)
+  }
+  return checksum
+}
+
 async function fetchText(url) {
   return new Promise((resolve, reject) => {
     https.get(url, (res) => {
@@ -80,54 +93,75 @@ async function fetchText(url) {
   })
 }
 
-async function main() {
-  const { key, name } = detectPlatform()
-  const binDir = path.join(__dirname, 'bin')
-  if (!fs.existsSync(binDir)) fs.mkdirSync(binDir, { recursive: true })
-  const localBin = path.join(binDir, process.platform === 'win32' ? 'pandanpc-mcp.exe' : 'pandanpc-mcp')
-
-  // Skip download if binary already exists (e.g. manually placed for development)
-  if (fs.existsSync(localBin) && fs.statSync(localBin).size > 0) {
-    console.log(`[pandanpc-mcp] binary already present at ${localBin}, skipping download`)
-    return
+function removeTemporaryFile(file) {
+  try { fs.unlinkSync(file) } catch (error) {
+    if (error?.code !== 'ENOENT') throw error
   }
+}
 
-  const url = `${BASE_URL}/${name}`
-  console.log(`[pandanpc-mcp] downloading ${url} -> ${localBin}`)
+async function ensureBinary({
+  key,
+  artifactName,
+  localBin,
+  platform = process.platform,
+  baseUrl = BASE_URL,
+  fetchTextFn = fetchText,
+  downloadFn = download,
+  sha256Fn = sha256,
+  logger = console,
+}) {
+  const sumsUrl = `${baseUrl}/SHA256SUMS`
+  const expected = checksumFor(await fetchTextFn(sumsUrl), artifactName)
 
-  try {
-    await download(url, localBin)
-  } catch (err) {
-    console.error(`[pandanpc-mcp] download failed: ${err.message}`)
-    console.error(`[pandanpc-mcp] If you are on an unsupported platform, build from source: https://github.com/pandanpc/mcp-server`)
-    process.exit(1)
+  if (fs.existsSync(localBin) && fs.statSync(localBin).size > 0) {
+    const actual = await sha256Fn(localBin)
+    if (actual === expected) {
+      if (platform !== 'win32') fs.chmodSync(localBin, 0o755)
+      logger.log(`[pandanpc-mcp] verified cached binary for ${key}`)
+      return { installed: false, checksum: actual }
+    }
+    logger.warn(`[pandanpc-mcp] cached binary checksum is stale; downloading ${artifactName}`)
   }
 
-  // Verify SHA256 checksum
+  const temporaryBin = `${localBin}.download-${process.pid}-${Date.now()}`
+  const url = `${baseUrl}/${artifactName}`
+  logger.log(`[pandanpc-mcp] downloading ${url} -> ${localBin}`)
+
   try {
-    const sumsText = await fetchText(`${BASE_URL}/SHA256SUMS`)
-    const line = sumsText.split('\n').find((l) => l.includes(name))
-    if (line) {
-      const expected = line.trim().split(/\s+/)[0]
-      const actual = await sha256(localBin)
-      if (expected !== actual) {
-        fs.unlinkSync(localBin)
-        throw new Error(`SHA256 mismatch: expected ${expected}, got ${actual}`)
-      }
-      console.log(`[pandanpc-mcp] SHA256 verified`)
+    await downloadFn(url, temporaryBin)
+    const actual = await sha256Fn(temporaryBin)
+    if (actual !== expected) {
+      throw new Error(`SHA256 mismatch: expected ${expected}, got ${actual}`)
     }
-  } catch (err) {
-    console.warn(`[pandanpc-mcp] SHA256 verification skipped: ${err.message}`)
+    if (platform !== 'win32') fs.chmodSync(temporaryBin, 0o755)
+    fs.renameSync(temporaryBin, localBin)
+    logger.log('[pandanpc-mcp] SHA256 verified')
+    logger.log(`[pandanpc-mcp] installed for ${key}`)
+    return { installed: true, checksum: actual }
+  } catch (error) {
+    removeTemporaryFile(temporaryBin)
+    throw error
   }
+}
 
-  if (process.platform !== 'win32') {
-    fs.chmodSync(localBin, 0o755)
-  }
+async function main() {
+  const { key, name: artifactName } = detectPlatform()
+  const binDir = path.join(__dirname, 'bin')
+  if (!fs.existsSync(binDir)) fs.mkdirSync(binDir, { recursive: true })
+  const localBin = path.join(binDir, binaryName())
+
+  await ensureBinary({ key, artifactName, localBin })
+}
 
-  console.log(`[pandanpc-mcp] installed for ${key}`)
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('[pandanpc-mcp] install failed:', err.message)
+    console.error('[pandanpc-mcp] Build from source if the release artifact is unavailable: https://github.com/pandanpc/mcp-server')
+    process.exit(1)
+  })
 }
 
-main().catch((err) => {
-  console.error('[pandanpc-mcp] install failed:', err.message)
-  process.exit(1)
-})
+module.exports = {
+  checksumFor,
+  ensureBinary,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pandanpc/mcp-server",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "PandaNpc MCP Server — PandaNote and Agent connection management for Codex, Claude Code, and other MCP clients",
   "keywords": [
     "mcp",
@@ -20,6 +20,7 @@
     "pandanpc-mcp": "index.js"
   },
   "files": [
+    "binary-name.js",
     "index.js",
     "install.js",
     "README.md"