@vibecook/truffle 0.4.6 → 0.4.8

package/dist/create-mesh-node.d.ts

@@ -36,7 +36,7 @@ export interface CreateMeshNodeOptions {
     authKey?: string;
     /** Whether this node is ephemeral (removed from tailnet on stop). */
     ephemeral?: boolean;
-    /** WebSocket listener port (0 = auto). */
+    /** WebSocket listener port. Defaults to 9417 when omitted. */
     wsPort?: number;
     /**
      * Auto-open the Tailscale auth URL in the default browser.

package/dist/create-mesh-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-mesh-node.d.ts","sourceRoot":"","sources":["../src/create-mesh-node.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAuB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG7F;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C;AAmBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuDtF"}
+{"version":3,"file":"create-mesh-node.d.ts","sourceRoot":"","sources":["../src/create-mesh-node.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAuB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG7F;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2EtF"}

package/dist/create-mesh-node.js

@@ -1,24 +1,24 @@
-import { execSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { NapiNode } from '@vibecook/truffle-native';
 import { resolveSidecarPath } from './sidecar.js';
 /**
  * Open a URL in the system's default browser.
  */
 function defaultOpenUrl(url) {
-    try {
-        if (process.platform === 'darwin') {
-            execSync(`open "${url}"`);
-        }
-        else if (process.platform === 'win32') {
-            execSync(`start "" "${url}"`);
-        }
-        else {
-            execSync(`xdg-open "${url}"`);
-        }
-    }
-    catch {
-        // Silently fail
-    }
+    // Only ever open http(s) URLs, and pass the URL as an argv element (never
+    // through a shell) so it cannot be interpreted as a command. The previous
+    // `execSync(`open "${url}"`)` form let shell metacharacters ($(), backticks)
+    // in the URL execute arbitrary commands.
+    if (!/^https?:\/\//i.test(url))
+        return;
+    const [cmd, args] = process.platform === 'darwin'
+        ? ['open', [url]]
+        : process.platform === 'win32'
+            ? ['explorer', [url]]
+            : ['xdg-open', [url]];
+    execFile(cmd, args, () => {
+        // Best-effort; ignore failures (no browser, headless environment, etc.).
+    });
 }
 /**
  * Create and start a Truffle node with sensible defaults.
@@ -41,6 +41,12 @@ function defaultOpenUrl(url) {
  */
 export async function createMeshNode(options) {
     const { appId, deviceName, deviceId, autoAuth = true, openUrl: customOpenUrl, onAuthRequired, onPeerChange, sidecarPath, stateDir, authKey, ephemeral, wsPort, } = options;
+    // Validate appId synchronously (mirrors the Rust-side rule) so a bad value
+    // fails here with a clear error instead of asynchronously across the FFI.
+    if (!/^[a-z][a-z0-9-]{1,31}$/.test(appId)) {
+        throw new Error(`[truffle] Invalid appId ${JSON.stringify(appId)}: must match ^[a-z][a-z0-9-]{1,31}$ ` +
+            `(2–32 chars; lowercase letters, digits, hyphens; must start with a letter).`);
+    }
     const resolvedSidecarPath = sidecarPath ?? resolveSidecarPath();
     const node = new NapiNode();
     // IMPORTANT: install the auth-required callback BEFORE calling `start()`.
@@ -68,7 +74,20 @@ export async function createMeshNode(options) {
         ephemeral,
         wsPort,
     };
-    await node.start(config);
+    try {
+        await node.start(config);
+    }
+    catch (err) {
+        // Best-effort cleanup so a failed start doesn't leak the spawned sidecar
+        // process. `stop()` is safe to call even if start() failed early.
+        try {
+            await node.stop();
+        }
+        catch {
+            // ignore — nothing to clean up, or already torn down
+        }
+        throw err;
+    }
     // Post-start: forward ongoing peer lifecycle events to the user callback.
     if (onPeerChange) {
         node.onPeerChange(onPeerChange);

package/dist/create-mesh-node.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-mesh-node.js","sourceRoot":"","sources":["../src/create-mesh-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAA2C,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAyDlD;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,EACJ,KAAK,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,OAAO,EAAE,aAAa,EACtB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,OAAO,EACP,SAAS,EACT,MAAM,GACP,GAAG,OAAO,CAAC;IAEZ,MAAM,mBAAmB,GAAG,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAEhE,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAE5B,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,wEAAwE;IACxE,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC,cAAc,CAAC,CAAC,GAAW,EAAE,EAAE;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,aAAa,IAAI,cAAc,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QACD,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAmB;QAC7B,KAAK;QACL,UAAU;QACV,QAAQ;QACR,WAAW,EAAE,mBAAmB;QAChC,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM;KACP,CAAC;IAEF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEzB,0EAA0E;IAC1E,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"create-mesh-node.js","sourceRoot":"","sources":["../src/create-mesh-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAA2C,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAyDlD;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,yCAAyC;IACzC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO;IACvC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GACf,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;QACvB,yEAAyE;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,EACJ,KAAK,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,OAAO,EAAE,aAAa,EACtB,cAAc,EACd,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,OAAO,EACP,SAAS,EACT,MAAM,GACP,GAAG,OAAO,CAAC;IAEZ,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sCAAsC;YACpF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAEhE,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAE5B,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,wEAAwE;IACxE,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC,cAAc,CAAC,CAAC,GAAW,EAAE,EAAE;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,aAAa,IAAI,cAAc,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QACD,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAmB;QAC7B,KAAK;QACL,UAAU;QACV,QAAQ;QACR,WAAW,EAAE,mBAAmB;QAChC,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM;KACP,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sidecar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar.d.ts","sourceRoot":"","sources":["../src/sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiBH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CA8B3C"}
+{"version":3,"file":"sidecar.d.ts","sourceRoot":"","sources":["../src/sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAyDH;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CA+B3C"}

package/dist/sidecar.js

@@ -8,11 +8,56 @@
  *
  * Follows the esbuild pattern for distributing platform-specific binaries.
  */
-import { existsSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
+/**
+ * Best-effort check that a local binary's architecture matches this process.
+ *
+ * The `bin/` fallback is populated by postinstall for the *current* platform,
+ * but a stray/leftover binary of the wrong arch would otherwise be returned and
+ * fail later with a cryptic `ENOEXEC`. We sniff the executable's magic bytes and
+ * only reject on a *positive* mismatch; when we can't tell, we allow it.
+ */
+function binaryMatchesPlatform(path) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch {
+        return false;
+    }
+    try {
+        const buf = Buffer.alloc(20);
+        if (readSync(fd, buf, 0, 20, 0) < 20)
+            return true; // too small to judge
+        // Mach-O 64-bit (macOS): LE magic 0xFEEDFACF, cputype at offset 4.
+        if (buf[0] === 0xcf && buf[1] === 0xfa && buf[2] === 0xed && buf[3] === 0xfe) {
+            const cpuType = buf.readUInt32LE(4);
+            if (process.arch === 'arm64')
+                return cpuType === 0x0100000c; // CPU_TYPE_ARM64
+            if (process.arch === 'x64')
+                return cpuType === 0x01000007; // CPU_TYPE_X86_64
+            return true;
+        }
+        // ELF (Linux): magic 0x7F 'E' 'L' 'F', e_machine at offset 18 (LE).
+        if (buf[0] === 0x7f && buf[1] === 0x45 && buf[2] === 0x4c && buf[3] === 0x46) {
+            const machine = buf.readUInt16LE(18);
+            if (process.arch === 'x64')
+                return machine === 0x3e; // EM_X86_64
+            if (process.arch === 'arm64')
+                return machine === 0xb7; // EM_AARCH64
+            return true;
+        }
+        // PE (Windows) / unknown format — don't block.
+        return true;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 const PLATFORM_PACKAGES = {
     'darwin-arm64': '@vibecook/truffle-sidecar-darwin-arm64',
     'darwin-x64': '@vibecook/truffle-sidecar-darwin-x64',
@@ -46,10 +91,11 @@ export function resolveSidecarPath() {
             // Package not installed — fall through
         }
     }
-    // 2. Try postinstall-downloaded binary (fallback)
+    // 2. Try postinstall-downloaded binary (fallback), but only if its arch
+    //    matches this process — a wrong-arch leftover would fail with ENOEXEC.
     const __dirname = dirname(fileURLToPath(import.meta.url));
     const localBin = join(__dirname, '..', 'bin', binName);
-    if (existsSync(localBin))
+    if (existsSync(localBin) && binaryMatchesPlatform(localBin))
         return localBin;
     // 3. Nothing found
     const supported = Object.keys(PLATFORM_PACKAGES).join(', ');

package/dist/sidecar.js.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar.js","sourceRoot":"","sources":["../src/sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,iBAAiB,GAA2B;IAChD,cAAc,EAAE,wCAAwC;IACxD,YAAY,EAAE,sCAAsC;IACpD,WAAW,EAAE,qCAAqC;IAClD,aAAa,EAAE,uCAAuC;IACtD,WAAW,EAAE,qCAAqC;CACnD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,eAAe,GAAG,EAAE,CAAC;IAErC,4DAA4D;IAC5D,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,mBAAmB;IACnB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,MAAM;QAC3D,wBAAwB,SAAS,IAAI;QACrC,mDAAmD;QACnD,gFAAgF,CACnF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sidecar.js","sourceRoot":"","sources":["../src/sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;QAExE,mEAAmE;QACnE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,iBAAiB;YAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,kBAAkB;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,YAAY;YACjE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,aAAa;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,+CAA+C;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAA2B;IAChD,cAAc,EAAE,wCAAwC;IACxD,YAAY,EAAE,sCAAsC;IACpD,WAAW,EAAE,qCAAqC;IAClD,aAAa,EAAE,uCAAuC;IACtD,WAAW,EAAE,qCAAqC;CACnD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,eAAe,GAAG,EAAE,CAAC;IAErC,4DAA4D;IAC5D,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE7E,mBAAmB;IACnB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,MAAM;QAC3D,wBAAwB,SAAS,IAAI;QACrC,mDAAmD;QACnD,gFAAgF,CACnF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Mesh networking for local-first apps, built on Tailscale",
   "license": "MIT",
   "author": "James Yong",
@@ -40,15 +40,15 @@
   },
   "files": [
     "dist",
-    "bin",
-    "scripts"
+    "scripts",
+    "sidecar-checksums.json"
   ],
   "dependencies": {
-    "@vibecook/truffle-native": "0.4.6"
+    "@vibecook/truffle-native": "0.4.8"
   },
   "optionalDependencies": {
-    "@vibecook/truffle-sidecar-darwin-arm64": "^0.3.0",
-    "@vibecook/truffle-sidecar-darwin-x64": "^0.4.3",
+    "@vibecook/truffle-sidecar-darwin-arm64": "^0.4.6",
+    "@vibecook/truffle-sidecar-darwin-x64": "^0.4.6",
     "@vibecook/truffle-sidecar-linux-x64": "^0.4.5",
     "@vibecook/truffle-sidecar-linux-arm64": "^0.4.5",
     "@vibecook/truffle-sidecar-win32-x64": "^0.4.5"

package/scripts/postinstall.cjs

@@ -3,19 +3,34 @@
 /**
  * Postinstall script for @vibecook/truffle.
  *
- * Verifies the sidecar binary is available via optionalDependencies.
- * If missing (e.g., --no-optional), falls back to downloading from GitHub Releases.
+ * Primary path: the platform-specific sidecar arrives via optionalDependencies
+ * (npm integrity-protected). Fallback (e.g. `--no-optional`): download the
+ * binary from GitHub Releases over HTTPS, then verify its SHA-256 against the
+ * checksums shipped *inside this package* (`sidecar-checksums.json`). When a
+ * checksum is present we fail closed on mismatch; when absent we warn loudly
+ * that integrity could not be verified.
  *
- * This follows the esbuild pattern: optionalDependencies as primary, HTTP download as fallback.
+ * This replaces the previous unverified `curl | chmod +x` fallback.
  */
 
 /* eslint-disable @typescript-eslint/no-require-imports */
 
-const { existsSync, mkdirSync, chmodSync } = require('fs');
+const {
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  createWriteStream,
+  createReadStream,
+  readFileSync,
+  unlinkSync,
+} = require('fs');
 const { join, dirname } = require('path');
-const { execSync } = require('child_process');
+const https = require('https');
+const crypto = require('crypto');
 
 const GITHUB_REPO = 'jamesyong-42/truffle';
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+const MAX_ATTEMPTS = 3;
 
 const PLATFORM_PACKAGES = {
   'darwin-arm64': '@vibecook/truffle-sidecar-darwin-arm64',
@@ -34,18 +49,74 @@ const GITHUB_ASSETS = {
   'win32-x64': 'tsnet-sidecar-windows-amd64.exe',
 };
 
-function main() {
+/** Download `url` to `dest` over HTTPS, following redirects, with a hard timeout. */
+function httpsDownload(url, dest, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { headers: { 'User-Agent': 'truffle-postinstall' } }, (res) => {
+      // GitHub release downloads redirect to a CDN — follow 3xx.
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        httpsDownload(res.headers.location, dest, timeoutMs).then(resolve, reject);
+        return;
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        reject(new Error(`HTTP ${res.statusCode}`));
+        return;
+      }
+      const file = createWriteStream(dest);
+      res.pipe(file);
+      file.on('finish', () => file.close((err) => (err ? reject(err) : resolve())));
+      file.on('error', (err) => {
+        try {
+          unlinkSync(dest);
+        } catch {
+          /* ignore */
+        }
+        reject(err);
+      });
+    });
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`timed out after ${timeoutMs}ms`)));
+    req.on('error', reject);
+  });
+}
+
+/** Compute the hex SHA-256 of a file. */
+function sha256File(path) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const s = createReadStream(path);
+    s.on('data', (d) => hash.update(d));
+    s.on('end', () => resolve(hash.digest('hex')));
+    s.on('error', reject);
+  });
+}
+
+/** Look up the expected SHA-256 for a given version/asset from the shipped checksum map. */
+function loadExpectedChecksum(version, asset) {
+  try {
+    const map = JSON.parse(readFileSync(join(__dirname, '..', 'sidecar-checksums.json'), 'utf8'));
+    const byVersion = map[version] || map[`v${version}`];
+    return byVersion ? byVersion[asset] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+async function main() {
   const key = `${process.platform}-${process.arch}`;
   const pkg = PLATFORM_PACKAGES[key];
   const ext = process.platform === 'win32' ? '.exe' : '';
   const binName = `sidecar-slim${ext}`;
 
   if (!pkg) {
-    console.warn(`[truffle] No prebuilt sidecar for ${key}. Build from source: cd packages/sidecar-slim && go build`);
+    console.warn(
+      `[truffle] No prebuilt sidecar for ${key}. Build from source: cd packages/sidecar-slim && go build`,
+    );
     return;
   }
 
-  // Check if the optionalDependency was installed
+  // Primary: was the platform optionalDependency installed?
   try {
     const pkgJson = require.resolve(`${pkg}/package.json`);
     const binPath = join(dirname(pkgJson), 'bin', binName);
@@ -66,32 +137,69 @@ function main() {
     // Not installed — fall through to download
   }
 
-  // Fallback: download from GitHub Releases
+  // Fallback: download from GitHub Releases (verified).
   const asset = GITHUB_ASSETS[key];
   if (!asset) return;
 
   const version = require('../package.json').version;
   const url = `https://github.com/${GITHUB_REPO}/releases/download/v${version}/${asset}`;
+  const expected = loadExpectedChecksum(version, asset);
 
   console.log(`[truffle] Sidecar not found via npm. Downloading from GitHub Releases...`);
 
-  try {
-    const binDir = join(__dirname, '..', 'bin');
-    mkdirSync(binDir, { recursive: true });
-    const dest = join(binDir, binName);
-
-    execSync(`curl -fsSL "${url}" -o "${dest}"`, { stdio: 'pipe' });
-
-    if (process.platform !== 'win32') {
-      chmodSync(dest, 0o755);
+  const binDir = join(__dirname, '..', 'bin');
+  const dest = join(binDir, binName);
+
+  // Retry only the network download; a checksum mismatch is deterministic and
+  // must NOT be retried (it would just re-download the same bad bytes).
+  let downloaded = false;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      mkdirSync(binDir, { recursive: true });
+      await httpsDownload(url, dest, DOWNLOAD_TIMEOUT_MS);
+      downloaded = true;
+      break;
+    } catch (err) {
+      console.warn(`[truffle] Download attempt ${attempt}/${MAX_ATTEMPTS} failed: ${err.message}`);
     }
+  }
 
-    console.log(`[truffle] Sidecar downloaded successfully.`);
-  } catch {
+  if (!downloaded) {
     console.warn(`[truffle] Could not download sidecar binary.`);
     console.warn(`[truffle] Download manually: ${url}`);
-    console.warn(`[truffle] Or build from source: cd packages/sidecar-slim && go build -o bin/sidecar-slim`);
+    console.warn(
+      `[truffle] Or build from source: cd packages/sidecar-slim && go build -o bin/sidecar-slim`,
+    );
+    return;
   }
+
+  // Integrity check.
+  if (expected) {
+    const actual = await sha256File(dest);
+    if (actual.toLowerCase() !== expected.toLowerCase()) {
+      try {
+        unlinkSync(dest);
+      } catch {
+        /* ignore */
+      }
+      console.error(
+        `[truffle] SECURITY: sidecar checksum mismatch for v${version}/${asset}. ` +
+          `Deleted the download and refusing to install it. Expected ${expected}, got ${actual}.`,
+      );
+      return;
+    }
+  } else {
+    console.warn(
+      `[truffle] WARNING: no pinned checksum for v${version}/${asset}; integrity NOT verified. ` +
+        `Prefer installing with optionalDependencies enabled.`,
+    );
+  }
+
+  if (process.platform !== 'win32') {
+    chmodSync(dest, 0o755);
+  }
+
+  console.log(`[truffle] Sidecar downloaded${expected ? ' and verified' : ''}.`);
 }
 
 main();

package/sidecar-checksums.json

@@ -0,0 +1,12 @@
+{
+  "_comment": "SHA-256 of each GitHub Release sidecar asset, keyed by release version then by asset filename. This file ships inside the npm package (which npm integrity-protects), so it is the trust anchor for the postinstall HTTPS download fallback. When an entry for the installing version/asset is present, postinstall FAILS CLOSED on a checksum mismatch; when absent it warns that integrity was not verified. Populate this at release time, e.g. `shasum -a 256 tsnet-sidecar-*` over the built assets. Keys must match GITHUB_ASSETS in scripts/postinstall.cjs.",
+  "_example": {
+    "0.4.7": {
+      "tsnet-sidecar-darwin-arm64": "<sha256-hex>",
+      "tsnet-sidecar-darwin-amd64": "<sha256-hex>",
+      "tsnet-sidecar-linux-amd64": "<sha256-hex>",
+      "tsnet-sidecar-linux-arm64": "<sha256-hex>",
+      "tsnet-sidecar-windows-amd64.exe": "<sha256-hex>"
+    }
+  }
+}