@standardagents/code 0.14.2 → 0.14.3-canary.6cc75f

package/lib/artifact.mjs

@@ -84,10 +84,114 @@ export function verifyArtifactTree(root, files, metadata = ['manifest.json', 'ma
   }
 }
 
-export const ARTIFACT_TARGETS = Object.freeze([
+// Check a native signed archive's listing before extraction: `names` from
+// `tar -tzf` and the entry type letters from `tar -tvzf`. The archive must be
+// exactly one of the signed layouts, with only regular files and the
+// directories those files need. Returns the matching file list.
+export function nativeArchiveLayout(names, types) {
+  const listed = names.map(name => name.replace(/^\.\//, '')).sort()
+  const layout = [ARTIFACT_FILES, BUNDLE_ARTIFACT_FILES, RUNNER_ARTIFACT_FILES, BUNDLE_RUNNER_ARTIFACT_FILES].find(files => {
+    const expected = [...artifactDirectories(files).map(path => `${path}/`), ...files, 'manifest.json', 'manifest.sig'].sort()
+    return listed.join('\n') === expected.join('\n')
+  })
+  if (!layout) throw new Error('native artifact archive has unexpected paths')
+  const expectedTypes = '-'.repeat(layout.length + 2) + 'd'.repeat(artifactDirectories(layout).length)
+  if ([...types].sort().join('') !== expectedTypes) {
+    throw new Error('native artifact archive must contain only regular files and expected directories')
+  }
+  return layout
+}
+
+// The four native targets the launcher has ever installed. The two deferred
+// ones stay so their published history verifies.
+export const NATIVE_ARTIFACT_TARGETS = Object.freeze([
   'aarch64-apple-darwin', 'x86_64-apple-darwin',
   'aarch64-unknown-linux-gnu', 'x86_64-unknown-linux-gnu',
 ])
+// The browser viewer runtime: a fifth, distinct artifact kind that the same
+// build workers compile and sign. It never installs through the launcher.
+export const WEB_ARTIFACT_TARGET = 'wasm32-unknown-unknown'
+export const ARTIFACT_TARGETS = Object.freeze([...NATIVE_ARTIFACT_TARGETS, WEB_ARTIFACT_TARGET])
+
+// Web artifact (schema 4): the wasm-bindgen output, the bundled fonts, their
+// licenses, and the build record, at the artifact root. The font and license
+// sets vary with the pinned font list, so the manifest enumerates what the
+// build produced and the verifier checks each path against these rules.
+export const WEB_ARTIFACT_FORMAT = 'standard-npm-web-target-v1'
+export const WEB_ARTIFACT_SCHEMA = 4
+export const WEB_ARTIFACT_REQUIRED_FILES = Object.freeze([
+  'build.json', 'pkg/standard_web.js', 'pkg/standard_web_bg.wasm',
+])
+export const WEB_ARTIFACT_OPTIONAL_FILES = Object.freeze([
+  'pkg/standard_web.d.ts', 'pkg/standard_web_bg.wasm.d.ts',
+])
+// One level deep, one file kind each; at least one entry of each.
+export const WEB_ARTIFACT_DIRECTORIES = Object.freeze({ fonts: /\.ttf$/, licenses: /\.txt$/ })
+export const WEB_ARTIFACT_FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+// The sample plugins' browser artifacts (packages/web/scripts/build-plugins.mjs),
+// optional: the Worker runtime and index at plugins/, and one directory per
+// plugin id holding its manifest, component, transpiled glue and core modules.
+export const WEB_ARTIFACT_PLUGIN_FILES = Object.freeze([
+  'plugins/worker.js', 'plugins/runtime.js', 'plugins/samples.json',
+])
+export const WEB_ARTIFACT_PLUGIN_ID = /^[a-z0-9][a-z0-9-]*$/
+export const WEB_ARTIFACT_PLUGIN_FILE = /^[A-Za-z0-9][A-Za-z0-9._-]*\.(?:js|wasm|json)$/
+export const MAX_WEB_ASSET_BYTES = 64 * 1024 * 1024
+
+// Whether one artifact-relative path may appear in a web artifact.
+export function webArtifactPathAllowed(path) {
+  if (typeof path !== 'string') return false
+  const parts = path.split('/')
+  if (!parts.every(part => WEB_ARTIFACT_FILE_NAME.test(part))) return false
+  if (WEB_ARTIFACT_REQUIRED_FILES.includes(path) || WEB_ARTIFACT_OPTIONAL_FILES.includes(path)) return true
+  if (WEB_ARTIFACT_PLUGIN_FILES.includes(path)) return true
+  if (parts.length === 3 && parts[0] === 'plugins') {
+    return WEB_ARTIFACT_PLUGIN_ID.test(parts[1]) && WEB_ARTIFACT_PLUGIN_FILE.test(parts[2])
+  }
+  return parts.length === 2 && Boolean(WEB_ARTIFACT_DIRECTORIES[parts[0]]?.test(parts[1]))
+}
+
+// Whether a directory (without its trailing slash) may appear in a web
+// artifact: pkg, the fixed directories, plugins, and one per plugin id.
+export function webArtifactDirectoryAllowed(path) {
+  if (path === 'pkg' || path === 'plugins' || Object.hasOwn(WEB_ARTIFACT_DIRECTORIES, path)) return true
+  const parts = path.split('/')
+  return parts.length === 2 && parts[0] === 'plugins' && WEB_ARTIFACT_PLUGIN_ID.test(parts[1])
+}
+
+// Check a complete web file list: every path allowed, every required file
+// present, each directory non-empty, no duplicates. Returns the sorted list.
+export function webArtifactFileList(paths) {
+  if (!Array.isArray(paths) || paths.some(path => !webArtifactPathAllowed(path))) {
+    throw new Error('Web artifact file manifest is invalid')
+  }
+  const files = [...paths].sort()
+  if (new Set(files).size !== files.length) throw new Error('Web artifact file manifest is invalid')
+  const missing = WEB_ARTIFACT_REQUIRED_FILES.filter(path => !files.includes(path))
+  for (const directory of Object.keys(WEB_ARTIFACT_DIRECTORIES)) {
+    if (!files.some(path => path.startsWith(`${directory}/`))) missing.push(`${directory}/`)
+  }
+  if (missing.length) throw new Error(`Web artifact is incomplete: missing ${missing.join(', ')}`)
+  return files
+}
+
+// Enumerate a built web artifact root as the file list its manifest binds.
+// Every entry must be a regular file the rules allow; anything else fails.
+export function webArtifactFilesOnDisk(root, metadata = ['manifest.json', 'manifest.sig']) {
+  const files = []
+  function visit(relative) {
+    for (const name of readdirSync(join(root, relative))) {
+      const child = relative ? `${relative}/${name}` : name
+      if (!relative && metadata.includes(child)) continue
+      const entry = lstatSync(join(root, child))
+      if (entry.isDirectory() && webArtifactDirectoryAllowed(child)) visit(child)
+      else if (!entry.isFile() || !webArtifactPathAllowed(child)) throw new Error(`Unexpected artifact content: ${child}`)
+      else files.push(child)
+    }
+  }
+  visit('')
+  return webArtifactFileList(files)
+}
 // Public trust anchor, not a credential. Never obtain the verification key
 // from the package being verified or a mutable registry response.
 export const ARTIFACT_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
@@ -124,20 +228,47 @@ function boundedBytes(path, limit) {
   } finally { closeSync(descriptor) }
 }
 
-export function verifyNativeArtifact(root, expected = {}, publicKey = ARTIFACT_PUBLIC_KEY) {
-  for (const directory of [root]) {
-    if (!lstatSync(directory).isDirectory()) throw new Error(`Invalid artifact directory: ${directory}`)
-  }
+// Read and authenticate an artifact's manifest against the pinned key. The
+// bytes that were signed are the bytes parsed; nothing is trusted before this.
+function signedManifest(root, publicKey, label) {
+  if (!lstatSync(root).isDirectory()) throw new Error(`Invalid artifact directory: ${root}`)
   const bytes = boundedBytes(join(root, 'manifest.json'), 64 * 1024)
   const signature = boundedBytes(join(root, 'manifest.sig'), 256).toString('utf8').trim()
   const key = createPublicKey(publicKey)
   if (key.asymmetricKeyType !== 'ed25519' || !verify(null, bytes, key, Buffer.from(signature, 'base64'))) {
-    throw new Error('Native artifact signature is invalid')
+    throw new Error(`${label} artifact signature is invalid`)
   }
-  const manifest = JSON.parse(bytes)
+  return JSON.parse(bytes)
+}
+
+// Every manifested file must exist with exactly its signed size and digest.
+function verifyFileDigests(root, manifest, limitFor, label) {
+  const buffer = Buffer.alloc(1024 * 1024)
+  for (const file of manifest.files) {
+    if (!Number.isSafeInteger(file.size) || !/^[0-9a-f]{64}$/.test(file.sha256)) throw new Error(`${label} artifact file metadata is invalid`)
+    const path = join(root, file.path)
+    const { descriptor, metadata } = regularFile(path, limitFor(file.path))
+    try {
+      if (metadata.size !== file.size) throw new Error(`${label} artifact size mismatch: ${file.path}`)
+      const hash = createHash('sha256')
+      let size = 0
+      for (;;) {
+        const count = readSync(descriptor, buffer, 0, buffer.length, null)
+        if (!count) break
+        size += count
+        if (size > file.size) throw new Error(`${label} artifact grew while verifying: ${file.path}`)
+        hash.update(buffer.subarray(0, count))
+      }
+      if (size !== file.size || hash.digest('hex') !== file.sha256) throw new Error(`${label} artifact digest mismatch: ${file.path}`)
+    } finally { closeSync(descriptor) }
+  }
+}
+
+export function verifyNativeArtifact(root, expected = {}, publicKey = ARTIFACT_PUBLIC_KEY) {
+  const manifest = signedManifest(root, publicKey, 'Native')
   const files = artifactFiles(manifest)
   if (manifest.repository !== 'standardagents/code-rs'
-    || !ARTIFACT_TARGETS.includes(manifest.target)
+    || !NATIVE_ARTIFACT_TARGETS.includes(manifest.target)
     || !/^[0-9a-f]{40}$/.test(manifest.commit)
     || !validArtifactVersion(manifest.version)
     || ['commit', 'version', 'target'].some(name => expected[name] != null && manifest[name] !== expected[name])
@@ -182,25 +313,39 @@ export function verifyNativeArtifact(root, expected = {}, publicKey = ARTIFACT_P
   }
   if (manifest.target.endsWith('-unknown-linux-gnu')
     && !/^\d+\.\d+(?:\.\d+)?$/.test(manifest.runtime.minimumGlibc ?? '')) throw new Error('Linux artifact lacks its glibc requirement')
-  const buffer = Buffer.alloc(1024 * 1024)
-  for (const file of manifest.files) {
-    if (!Number.isSafeInteger(file.size) || !/^[0-9a-f]{64}$/.test(file.sha256)) throw new Error('Native artifact file metadata is invalid')
-    const path = join(root, file.path)
-    const { descriptor, metadata } = regularFile(path, runnerFiles.includes(file.path)
-      ? MAX_RUNNER_ASSET_BYTES : 256 * 1024 * 1024)
-    try {
-      if (metadata.size !== file.size) throw new Error(`Native artifact size mismatch: ${file.path}`)
-      const hash = createHash('sha256')
-      let size = 0
-      for (;;) {
-        const count = readSync(descriptor, buffer, 0, buffer.length, null)
-        if (!count) break
-        size += count
-        if (size > file.size) throw new Error(`Native artifact grew while verifying: ${file.path}`)
-        hash.update(buffer.subarray(0, count))
-      }
-      if (size !== file.size || hash.digest('hex') !== file.sha256) throw new Error(`Native artifact digest mismatch: ${file.path}`)
-    } finally { closeSync(descriptor) }
+  verifyFileDigests(root, manifest, path => runnerFiles.includes(path) ? MAX_RUNNER_ASSET_BYTES : 256 * 1024 * 1024, 'Native')
+  return manifest
+}
+
+// Verify a web artifact root: the Ed25519 signature, the schema-4 identity,
+// the file rules, the exact on-disk file set (nothing unmanifested, no
+// links), the build record, and every digest. Returns the manifest.
+export function verifyWebArtifact(root, expected = {}, publicKey = ARTIFACT_PUBLIC_KEY) {
+  const manifest = signedManifest(root, publicKey, 'Web')
+  if (manifest.schema !== WEB_ARTIFACT_SCHEMA || manifest.format !== WEB_ARTIFACT_FORMAT
+    || manifest.target !== WEB_ARTIFACT_TARGET
+    || manifest.repository !== 'standardagents/code-rs'
+    || !/^[0-9a-f]{40}$/.test(manifest.commit)
+    || !validArtifactVersion(manifest.version)
+    || ['commit', 'version', 'target'].some(name => expected[name] != null && manifest[name] !== expected[name])
+    || manifest.signing?.algorithm !== 'ed25519') throw new Error('Web artifact identity is invalid')
+  if (Object.hasOwn(manifest, 'backendProfile') && (manifest.backendProfile == null || manifest.backendProfile === '')) {
+    throw new Error('Web artifact backend profile cannot be null')
+  }
+  const backendProfile = normalizeBackendProfile(manifest.backendProfile)
+  if (backendProfile && !isPreviewBuild(manifest.version)) {
+    throw new Error('Web artifact preview backend profile is not valid for this version')
+  }
+  if (!Array.isArray(manifest.files)) throw new Error('Web artifact file manifest is invalid')
+  const files = webArtifactFileList(manifest.files.map(file => file?.path))
+  verifyArtifactTree(root, files)
+  verifyFileDigests(root, manifest, () => MAX_WEB_ASSET_BYTES, 'Web')
+  // The build record is the identity the bundle itself reports; it must name
+  // the signed build, not a local or foreign one.
+  let record
+  try { record = JSON.parse(boundedBytes(join(root, 'build.json'), 4096)) } catch { record = null }
+  if (record?.schema !== 1 || record.commit !== manifest.commit || record.version !== manifest.version) {
+    throw new Error('Web artifact build record does not name the signed build')
   }
   return manifest
 }

package/lib/install.mjs

@@ -0,0 +1,93 @@
+import { spawnSync } from 'node:child_process'
+import { createHash, randomUUID } from 'node:crypto'
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { artifactBinaryPath, nativeArchiveLayout, verifyNativeArtifact } from './artifact.mjs'
+
+// A release's root package names each native target's signed archive in
+// `standardArtifacts`; npm only selects the platform. The archive downloads
+// from the build coordinator, which serves it from R2, and installs under this
+// package's `native/<target>/` once its size, digest, layout, and signed
+// manifest all check out. The daemon's launcher repair finds it there too.
+export const ARTIFACT_ORIGIN = 'https://builds.standardcode.ai'
+const MAX_ARCHIVE = 128 * 1024 * 1024
+const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url))
+
+export function nativeDirectory(target, root = PACKAGE_ROOT) {
+  return join(root, 'native', target)
+}
+
+export function packageMetadata(root = PACKAGE_ROOT) {
+  return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+}
+
+// The signed archive a package names for `target`, or null when its binaries
+// install as an npm platform package instead.
+export function artifactPointer(metadata, target) {
+  const artifacts = metadata.standardArtifacts
+  if (artifacts === undefined) return null
+  const pointer = artifacts?.schema === 1 ? artifacts.targets?.[target] : undefined
+  if (!pointer
+    || pointer.url !== `${ARTIFACT_ORIGIN}/artifacts/${metadata.version}/${target}.tar.gz`
+    || !/^[0-9a-f]{64}$/.test(pointer.sha256 ?? '')
+    || !Number.isSafeInteger(pointer.size) || pointer.size < 1 || pointer.size > MAX_ARCHIVE) {
+    throw new Error(`This package names no valid native archive for ${target}`)
+  }
+  return pointer
+}
+
+// The installed, verified artifact directory for `target`, or null.
+export function installedArtifact(target, root = PACKAGE_ROOT, publicKey = undefined) {
+  const directory = nativeDirectory(target, root)
+  try {
+    return { directory, manifest: verifyNativeArtifact(directory, { version: packageMetadata(root).version, target }, publicKey) }
+  } catch {
+    return null
+  }
+}
+
+function tar(run, args) {
+  const result = run('tar', args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 })
+  if (result.error) throw result.error
+  if (result.status !== 0) throw new Error(`tar ${args[0]} failed: ${result.stderr}`)
+  return result.stdout
+}
+
+export async function installNativeArtifact({ target, root = PACKAGE_ROOT, fetchImplementation = fetch, run = spawnSync, publicKey = undefined }) {
+  const installed = installedArtifact(target, root, publicKey)
+  if (installed) return installed.directory
+  const metadata = packageMetadata(root)
+  const pointer = artifactPointer(metadata, target)
+  if (!pointer) throw new Error(`This package carries no native archive for ${target}`)
+  const response = await fetchImplementation(pointer.url)
+  if (!response.ok) throw new Error(`Downloading the native archive failed with HTTP ${response.status}`)
+  const bytes = Buffer.from(await response.arrayBuffer())
+  if (bytes.length !== pointer.size || createHash('sha256').update(bytes).digest('hex') !== pointer.sha256) {
+    throw new Error('The downloaded native archive does not match its published size and digest')
+  }
+  const work = join(root, 'native', `.install-${randomUUID()}`)
+  mkdirSync(work, { recursive: true, mode: 0o700 })
+  try {
+    const archive = join(work, 'archive.tar.gz')
+    writeFileSync(archive, bytes, { mode: 0o600, flag: 'wx' })
+    nativeArchiveLayout(
+      tar(run, ['-tzf', archive]).trim().split('\n'),
+      tar(run, ['-tvzf', archive]).trim().split('\n').map(line => line[0]),
+    )
+    const extracted = join(work, 'artifact')
+    mkdirSync(extracted, { mode: 0o700 })
+    tar(run, ['-xzf', archive, '-C', extracted])
+    const manifest = verifyNativeArtifact(extracted, { version: metadata.version, target }, publicKey)
+    for (const command of ['standard', 'standardd', 'tmux']) {
+      chmodSync(join(extracted, artifactBinaryPath(manifest, command)), 0o755)
+    }
+    const destination = nativeDirectory(target, root)
+    rmSync(destination, { recursive: true, force: true })
+    renameSync(extracted, destination)
+    return destination
+  } finally {
+    rmSync(work, { recursive: true, force: true })
+  }
+}

package/lib/launcher.mjs

@@ -1,11 +1,12 @@
 import { spawnSync } from 'node:child_process'
 import { readFileSync, realpathSync, statSync } from 'node:fs'
 import { createRequire } from 'node:module'
-import { dirname, join } from 'node:path'
+import { dirname, isAbsolute, join } from 'node:path'
 import process from 'node:process'
 
 import { platformPackage } from './platform.mjs'
 import { artifactBinaryPath, requireCompatibleGlibc, verifyNativeArtifact } from './artifact.mjs'
+import { artifactPointer, installNativeArtifact, installedArtifact, nativeDirectory, packageMetadata } from './install.mjs'
 
 const require = createRequire(import.meta.url)
 const COMMANDS = new Set(['standard', 'standardd'])
@@ -18,7 +19,7 @@ export function resolveBinary(command, options = {}) {
   const overrideDirectory = environment.STANDARD_CODE_BINARY_DIR
   const binaryPath = overrideDirectory
     ? join(overrideDirectory, command)
-    : resolvePackagedBinary(command, options)
+    : stableBinary(command, options) ?? resolvePackagedBinary(command, options)
   const stat = statSync(binaryPath)
   if (!stat.isFile()) {
     throw new Error(`Resolved Standard executable is not a file: ${binaryPath}`)
@@ -26,6 +27,39 @@ export function resolveBinary(command, options = {}) {
   return binaryPath
 }
 
+// The daemon records its last stably booted native release as
+// native-releases/stable. Starting it makes this package's age irrelevant:
+// that build selects the account's active release with its own current
+// verification rules. The packaged build remains the first-install fallback.
+export function stableBinary(command, options = {}) {
+  const environment = options.environment ?? process.env
+  const home = environment.HOME
+  const argumentsList = options.arguments ?? process.argv.slice(2)
+  if (!home || !isAbsolute(home)
+    || argumentsList.some(argument => argument === '--state-dir' || argument.startsWith('--state-dir='))) {
+    return null
+  }
+  const { rustTarget } = platformPackage(options.platform, options.architecture, options.report)
+  const relative = rustTarget.endsWith('-unknown-linux-gnu')
+    ? `bin/${command}`
+    : `${command === 'standard' ? 'Standard Code' : 'Standard Code Daemon'}.app/Contents/MacOS/${command}`
+  const uid = options.uid ?? process.getuid?.()
+  try {
+    const root = realpathSync(join(home, '.local/share/standard-code/state/native-releases'))
+    const slot = realpathSync(join(root, 'stable'))
+    if (dirname(slot) !== join(root, rustTarget)) return null
+    for (const directory of [root, slot]) {
+      const info = statSync(directory)
+      if (!info.isDirectory() || info.uid !== uid || (info.mode & 0o077) !== 0) return null
+    }
+    const binary = join(slot, relative)
+    const info = statSync(binary)
+    return info.isFile() && info.uid === uid ? binary : null
+  } catch {
+    return null
+  }
+}
+
 function resolvePackagedBinary(command, options) {
   const platform = platformPackage(
     options.platform,
@@ -33,11 +67,18 @@ function resolvePackagedBinary(command, options) {
     options.report,
   )
   const resolve = options.resolve ?? require.resolve
+  const report = options.report ?? process.report
+  // A release that carries no binaries on npm installs its signed R2 archive
+  // under this package instead (see install.mjs).
+  const downloaded = installedArtifact(platform.rustTarget, options.packageRoot)
+  if (downloaded) {
+    requireCompatibleGlibc(downloaded.manifest, report?.getReport()?.header?.glibcVersionRuntime)
+    return join(downloaded.directory, artifactBinaryPath(downloaded.manifest, command))
+  }
   try {
     const root = dirname(realpathSync(resolve(`${platform.packageName}/manifest.json`)))
     const version = JSON.parse(readFileSync(new URL('../package.json', import.meta.url))).version
     const artifact = verifyNativeArtifact(root, { version, target: platform.rustTarget })
-    const report = options.report ?? process.report
     requireCompatibleGlibc(artifact, report?.getReport()?.header?.glibcVersionRuntime)
     return join(root, artifactBinaryPath(artifact, command))
   } catch (error) {
@@ -57,8 +98,41 @@ export function spawnBinary(command, args, options = {}) {
   })
 }
 
-export function main(command) {
+// Install this platform's signed R2 archive when the package names one and
+// has no binaries installed yet. The package has no install script, so npm
+// and pnpm install it without an allow-scripts prompt, and the first launch
+// downloads and verifies the native build here (#684).
+export async function ensureNativeBinaries(options = {}) {
+  if (options.environment?.STANDARD_CODE_BINARY_DIR ?? process.env.STANDARD_CODE_BINARY_DIR) return
+  const platform = platformPackage(options.platform, options.architecture, options.report)
+  if (installedArtifact(platform.rustTarget, options.packageRoot)) return
+  if (!artifactPointer(packageMetadata(options.packageRoot), platform.rustTarget)) return
+  try {
+    const resolve = options.resolve ?? require.resolve
+    resolve(`${platform.packageName}/manifest.json`)
+    return
+  } catch {
+    // No npm platform package: download the archive.
+  }
+  const log = options.log ?? (message => console.error(message))
+  log(`standard: installing the native build for ${platform.rustTarget} (first launch)`)
+  try {
+    await installNativeArtifact({ target: platform.rustTarget, root: options.packageRoot, fetchImplementation: options.fetchImplementation })
+  } catch (error) {
+    if (error?.code === 'EACCES' || error?.code === 'EPERM') {
+      throw new Error(
+        `cannot write the native build under ${nativeDirectory(platform.rustTarget, options.packageRoot)}. `
+        + 'The package belongs to another user (for example an npm install run with sudo); '
+        + 'reinstall @standardagents/code with an npm prefix you own.',
+      )
+    }
+    throw error
+  }
+}
+
+export async function main(command) {
   try {
+    await ensureNativeBinaries()
     const result = spawnBinary(command, process.argv.slice(2))
     if (result.error) throw result.error
     if (result.signal) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardagents/code",
-  "version": "0.14.2",
+  "version": "0.14.3-canary.6cc75f",
   "description": "Platform launcher for the Standard universal terminal network.",
   "type": "module",
   "license": "UNLICENSED",
@@ -21,19 +21,29 @@
   },
   "files": [
     "bin",
-    "lib",
-    "postinstall.mjs"
+    "lib"
   ],
-  "scripts": {
-    "postinstall": "node postinstall.mjs"
-  },
-  "optionalDependencies": {
-    "@standardagents/code-darwin-arm64": "npm:@standardagents/code@0.14.2-darwin-arm64",
-    "@standardagents/code-linux-x64-gnu": "npm:@standardagents/code@0.14.2-linux-x64-gnu"
+  "standardArtifacts": {
+    "schema": 1,
+    "targets": {
+      "aarch64-apple-darwin": {
+        "url": "https://builds.standardcode.ai/artifacts/0.14.3-canary.6cc75f/aarch64-apple-darwin.tar.gz",
+        "sha256": "45f9458727aae1a6ed80dad7f8bff778d271a56b5148e3cdc9fceb22fafa2410",
+        "size": 22931785
+      },
+      "x86_64-unknown-linux-gnu": {
+        "url": "https://builds.standardcode.ai/artifacts/0.14.3-canary.6cc75f/x86_64-unknown-linux-gnu.tar.gz",
+        "sha256": "ef44b1a6a2c3623143f2dcb0505b56cce65d8649d21441cfe4373ed59bf5f6de",
+        "size": 28560078
+      }
+    }
   },
   "standardUpgrade": {
     "schema": 1,
     "reader": 1,
-    "bridge": null
+    "bridge": {
+      "version": "0.14.1-canary.76909e",
+      "commit": "76909e97ec56c2ba5490932135642962c4035596"
+    }
   }
 }

package/postinstall.mjs

@@ -1,12 +0,0 @@
-import { chmodSync } from 'node:fs'
-
-import { resolveBinary } from './lib/launcher.mjs'
-
-for (const command of ['standard', 'standardd']) {
-  try {
-    chmodSync(resolveBinary(command), 0o755)
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error)
-    console.warn(`@standardagents/code: ${detail}`)
-  }
-}