@stubbedev/atlassian-mcp 0.5.25 → 0.5.27

package/README.md

@@ -239,6 +239,16 @@ you declined the plugin: it downloads the binary on its first run, then hands ov
 Clients start the server from their own working directory, so use absolute paths. Set
 `ATLASSIAN_MCP_SKIP_DOWNLOAD=1` to skip the install-time download.
 
+#### Binary cache
+
+npm and Composer download each release's binary once per user, verify it against the
+release's `checksums.txt`, and keep it in `$XDG_CACHE_HOME/atlassian-mcp/<version>/` (by
+default `~/.cache` on Linux and FreeBSD, `~/Library/Caches` on macOS, `%LOCALAPPDATA%` on
+Windows), and hardlink it into every install, or copy it where the install is on another
+filesystem. Further projects and git worktrees on the same version install without
+downloading anything. Delete old version directories to reclaim their space; installs keep
+their own link.
+
 #### Standalone binary (Go, Nix, release download)
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stubbedev/atlassian-mcp",
-  "version": "0.5.25",
+  "version": "0.5.27",
   "description": "MCP server for self-hosted Jira and Bitbucket (Go, distributed as a prebuilt binary)",
   "license": "MIT",
   "type": "module",

package/scripts/download.mjs

@@ -1,23 +1,16 @@
-// Resolves (and, if needed, downloads) the prebuilt Go binary that matches the
-// current platform. Shared by the postinstall script and the CLI launcher so a
-// failed install (e.g. offline) self-heals on first run.
-import { createWriteStream } from 'node:fs';
-import { chmod, mkdir, rm, stat, rename } from 'node:fs/promises';
-import { Readable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { chmod, copyFile, link, mkdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readFileSync } from 'node:fs';
 
-const here = dirname(fileURLToPath(import.meta.url));
-const root = join(here, '..');
-const binDir = join(root, 'bin');
+const NAME = 'atlassian-mcp';
+const REPO = `stubbedev/${NAME}`;
+const SOURCE_HINT = `go install -tags nodynamic github.com/${REPO}@latest`;
 
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-const REPO = 'stubbedev/atlassian-mcp';
 
-// Map Node's platform/arch onto the Go release asset naming. Anything not
-// listed falls back to the "go install" hint in target().
 const PLATFORMS = {
   'linux:x64': { os: 'linux', arch: 'amd64', ext: '' },
   'linux:arm64': { os: 'linux', arch: 'arm64', ext: '' },
@@ -35,52 +28,105 @@ const PLATFORMS = {
   'freebsd:arm64': { os: 'freebsd', arch: 'arm64', ext: '' },
 };
 
+export async function ensureBinary() {
+  const dest = join(root, 'bin', `${NAME}-native${target().ext}`);
+  if (await present(dest)) return dest;
+  const cached = join(cacheDir(), asset());
+  if (!(await present(cached))) await fetchInto(cached);
+  await place(cached, dest);
+  return dest;
+}
+
 function target() {
   const key = `${process.platform}:${process.arch}`;
   const t = PLATFORMS[key];
   if (!t) {
-    throw new Error(
-      `Unsupported platform ${key}. Build from source with: go install github.com/${REPO}@latest`,
-    );
+    throw new Error(`Unsupported platform ${key}. Build from source with: ${SOURCE_HINT}`);
   }
   return t;
 }
 
-export function binaryPath() {
-  const { ext } = target();
-  return join(binDir, `atlassian-mcp-native${ext}`);
+function asset() {
+  const { os, arch, ext } = target();
+  return `${NAME}_${os}_${arch}${ext}`;
 }
 
-function assetUrl() {
-  const { os, arch, ext } = target();
-  return `https://github.com/${REPO}/releases/download/v${pkg.version}/atlassian-mcp_${os}_${arch}${ext}`;
+async function fetchInto(cached) {
+  await store(await fetchRelease(`v${pkg.version}`, asset()), cached);
 }
 
-async function exists(path) {
+function cacheDir() {
+  return join(cacheRoot(), NAME, pkg.version);
+}
+
+function cacheRoot() {
+  if (process.env.XDG_CACHE_HOME) return process.env.XDG_CACHE_HOME;
+  const [variable, ...suffix] =
+    { win32: ['LOCALAPPDATA'], darwin: ['HOME', 'Library', 'Caches'] }[process.platform] ?? ['HOME', '.cache'];
+  const base = process.env[variable];
+  if (!base) {
+    throw new Error(`Cannot locate a cache directory: neither XDG_CACHE_HOME nor ${variable} is set`);
+  }
+  return join(base, ...suffix);
+}
+
+async function present(path) {
   try {
     const s = await stat(path);
     return s.isFile() && s.size > 0;
-  } catch {
-    return false;
+  } catch (err) {
+    if (err.code === 'ENOENT') return false;
+    throw err;
   }
 }
 
-// ensureBinary returns the path to the platform binary, downloading it from the
-// matching GitHub release if it is not already present.
-export async function ensureBinary() {
-  const dest = binaryPath();
-  if (await exists(dest)) return dest;
+async function place(cached, dest) {
+  const tmp = await tmpBeside(dest);
+  try {
+    await link(cached, tmp).catch(() => copyFile(cached, tmp));
+    await commit(tmp, dest);
+  } finally {
+    await rm(tmp, { force: true });
+  }
+}
+
+async function commit(tmp, dest) {
+  await chmod(tmp, 0o755);
+  await rename(tmp, dest);
+}
+
+async function tmpBeside(file) {
+  await mkdir(dirname(file), { recursive: true });
+  return `${file}.${randomBytes(6).toString('hex')}.tmp`;
+}
 
-  await mkdir(binDir, { recursive: true });
-  const url = assetUrl();
+async function fetchRelease(tag, asset) {
+  const base = `https://github.com/${REPO}/releases/download/${tag}`;
+  const sums = (await get(`${base}/checksums.txt`)).toString('utf8');
+  const want = sums
+    .split('\n')
+    .map((line) => line.trim().split(/\s+\*?/))
+    .find(([, file]) => file === asset)?.[0];
+  if (!want) throw new Error(`${asset} is not listed in ${tag} checksums.txt`);
+  const data = await get(`${base}/${asset}`);
+  if (createHash('sha256').update(data).digest('hex') !== want) {
+    throw new Error(`Checksum mismatch for ${asset} from ${tag}`);
+  }
+  return data;
+}
+
+async function get(url) {
   const res = await fetch(url, { redirect: 'follow' });
-  if (!res.ok || !res.body) {
-    throw new Error(`Failed to download ${url}: HTTP ${res.status}`);
+  if (!res.ok) throw new Error(`Failed to download ${url}: HTTP ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+async function store(data, cached) {
+  const tmp = await tmpBeside(cached);
+  try {
+    await writeFile(tmp, data);
+    await commit(tmp, cached);
+  } finally {
+    await rm(tmp, { force: true });
   }
-  const tmp = `${dest}.download`;
-  await pipeline(Readable.fromWeb(res.body), createWriteStream(tmp));
-  await chmod(tmp, 0o755).catch(() => {});
-  await rm(dest, { force: true });
-  await rename(tmp, dest);
-  return dest;
 }