@viceme-ai/cli 0.16.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.16.1] - 2026-08-19
+
+### Fixes
+
+- 修复安装重试与启动信号传播 (`cae2f39`)
+- unbrick npm activation recovery and anchor launcher cache to the bundled checksum manifest (`acf28b2`)
+
 ## [0.16.0] - 2026-08-19
 
 ### Features

package/README.md

@@ -126,12 +126,14 @@ VICEME_REGION=global sh -c "$(curl -fsSL https://s3.viceme.ai/start/install.sh)"
 China:
 
 ```powershell
+[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 irm https://s3.viceme.cn/start/install.ps1 | iex
 ```
 
 International:
 
 ```powershell
+[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 $env:VICEME_REGION="global"; irm https://s3.viceme.ai/start/install.ps1 | iex
 ```
 

package/README.zh.md

@@ -117,12 +117,14 @@ VICEME_REGION=global sh -c "$(curl -fsSL https://s3.viceme.ai/start/install.sh)"
 中国区：
 
 ```powershell
+[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 irm https://s3.viceme.cn/start/install.ps1 | iex
 ```
 
 海外：
 
 ```powershell
+[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 $env:VICEME_REGION="global"; irm https://s3.viceme.ai/start/install.ps1 | iex
 ```
 

package/checksums.txt

@@ -1,6 +1,6 @@
-5d1a01daa98e11d4e8bbe4e06f369235f0b328b5622b413adf17d078dc19f149  viceme_0.16.0_darwin_amd64
-c5668fe1b1306a2553573cf5c9f96e80a81d2771444b5b5bde44c2ece73141fc  viceme_0.16.0_darwin_arm64
-6c2d3b2c5d6ad9fe8b1479872f08d0e8b3fe52c7ed7d6ad591542d6588da8fcf  viceme_0.16.0_linux_amd64
-0e472d484c38ac0b60acaa044d99b4913936abe96f0a4aef7e1c9e2db207fe3f  viceme_0.16.0_linux_arm64
-8ea8942c0ad36505fa46abec12177cb2f75e7eaf4bec6213aefeb6962debf4f0  viceme_0.16.0_windows_amd64.exe
-824895a0ea8b941b31944efb74ce339ba9be0782bc4b42043428146cc52df51c  viceme_0.16.0_windows_arm64.exe
+3d6f752fb10b3b8b90b0a76158115c74994da96d1aac71b842f4496dca245ec1  viceme_0.16.1_darwin_amd64
+310dd511ea791a37d4307efc8e7d48900fc8daf63a83288fcbc7d3b56823711c  viceme_0.16.1_darwin_arm64
+5689186a71e6cba254258f50397ea6f95872a8e2abfd56d41bdea97cf3167a9f  viceme_0.16.1_linux_amd64
+ed9d84c0a9cdc6a771a80d605b936d8aaa39ab2894270ecb962274f5729ddc10  viceme_0.16.1_linux_arm64
+bba8e0b483b27041b86983cf42922099d29deeb2aabf212b3b433cbd9492a010  viceme_0.16.1_windows_amd64.exe
+4896b58a6412f71d81b6129bcfd46ec80290799ac4aa02dd7063795ed80bef18  viceme_0.16.1_windows_arm64.exe

package/npm/bin/viceme.mjs

@@ -2,12 +2,21 @@
 
 import { spawnSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
+import { constants as osConstants } from "node:os";
 import { fileURLToPath } from "node:url";
 import process from "node:process";
 
 import { ensureBinary } from "../lib/installer.mjs";
 import { launcherEnvironment } from "../lib/launcher-environment.mjs";
 
+function signalExitCode(signal) {
+  const signalNumber = osConstants.signals[signal];
+  if (!Number.isInteger(signalNumber)) {
+    throw new Error(`unsupported child termination signal ${signal}`);
+  }
+  return 128 + signalNumber;
+}
+
 export async function main(args = process.argv.slice(2), environment = process.env) {
   const packageDocument = JSON.parse(
     await readFile(new URL("../../package.json", import.meta.url), "utf8"),
@@ -32,7 +41,7 @@ export async function main(args = process.argv.slice(2), environment = process.e
     throw child.error;
   }
   if (child.signal) {
-    return 128;
+    return signalExitCode(child.signal);
   }
   return child.status ?? 1;
 }

package/npm/lib/installer.mjs

@@ -1,6 +1,16 @@
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { access, chmod, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import {
+  access,
+  chmod,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
 import { constants } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -14,6 +24,7 @@ const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 const GENERATIONS_DIRECTORY = "generations";
 const GENERATION_PREFIX = "generation-";
 const STAGING_PREFIX = ".staging-";
+const BINARY_DOWNLOAD_TIMEOUT_MILLISECONDS = 10 * 60 * 1_000;
 
 export function releaseTarget(platform = process.platform, architecture = process.arch) {
   const operatingSystems = {
@@ -80,6 +91,7 @@ export async function ensureBinary({
   cacheDirectory,
   checksumsDocument,
   allowInsecureURL = false,
+  downloadTimeoutMilliseconds = BINARY_DOWNLOAD_TIMEOUT_MILLISECONDS,
 }) {
   if (environment.VICEME_BINARY_PATH) {
     const overridden = path.resolve(environment.VICEME_BINARY_PATH);
@@ -93,14 +105,17 @@ export async function ensureBinary({
   const root = cacheDirectory ?? defaultCacheDirectory(environment, platform);
   const destinationDirectory = path.join(root, "cli", packageVersion);
   const generationsDirectory = path.join(destinationDirectory, GENERATIONS_DIRECTORY);
-  const cached = await findValidGeneration(generationsDirectory, asset);
+  // The bundled checksum manifest is the trust root for every code path, cached
+  // generations included. A generation is only reusable when its bytes match
+  // the bundled digest, never merely a sidecar stored next to it.
+  const checksumSource =
+    checksumsDocument ?? (await readFile(CHECKSUMS_URL, "utf8"));
+  const expectedChecksum = checksumForAsset(checksumSource, asset);
+  const cached = await findValidGeneration(generationsDirectory, asset, expectedChecksum);
   if (cached) {
     return cached;
   }
   await mkdir(generationsDirectory, { recursive: true, mode: 0o700 });
-  const checksumSource =
-    checksumsDocument ?? (await readFile(CHECKSUMS_URL, "utf8"));
-  const expectedChecksum = checksumForAsset(checksumSource, asset);
   const urls = binaryDownloadURLs({
     packageVersion,
     asset,
@@ -114,12 +129,13 @@ export async function ensureBinary({
     urls,
     downloadImplementation,
     allowInsecureURL,
+    downloadTimeoutMilliseconds,
   });
 
   // If another cold start finished while this process downloaded, reuse its
   // complete immutable generation. Duplicate downloads are harmless; shared
   // partially-written binary/checksum pairs do not exist.
-  const publishedByContender = await findValidGeneration(generationsDirectory, asset);
+  const publishedByContender = await findValidGeneration(generationsDirectory, asset, expectedChecksum);
   if (publishedByContender) {
     return publishedByContender;
   }
@@ -140,7 +156,7 @@ export async function ensureBinary({
     await writeFile(stagedBinary, binary, { mode: 0o700 });
     await chmod(stagedBinary, 0o700);
     await writeFile(stagedChecksum, `${expectedChecksum}  ${asset}\n`, { mode: 0o600 });
-    if (!(await cachedBinaryIsValid(stagedBinary, stagedChecksum))) {
+    if (!(await binaryMatchesChecksum(stagedBinary, expectedChecksum))) {
       throw new Error(`staged binary verification failed for ${asset}`);
     }
 
@@ -152,7 +168,7 @@ export async function ensureBinary({
     await rm(stagingDirectory, { recursive: true, force: true });
   }
   const installedBinary = path.join(generationDirectory, asset);
-  if (!(await cachedBinaryIsValid(installedBinary, `${installedBinary}.sha256`))) {
+  if (!(await binaryMatchesChecksum(installedBinary, expectedChecksum))) {
     throw new Error(`published binary verification failed for ${asset}`);
   }
   return installedBinary;
@@ -216,11 +232,23 @@ async function downloadVerifiedBinary({
   urls,
   downloadImplementation,
   allowInsecureURL,
+  downloadTimeoutMilliseconds,
 }) {
+  if (!Number.isFinite(downloadTimeoutMilliseconds) || downloadTimeoutMilliseconds <= 0) {
+    throw new Error("binary download timeout must be greater than zero");
+  }
+  const deadline = Date.now() + downloadTimeoutMilliseconds;
   const failures = [];
   for (const url of urls) {
+    const remainingMilliseconds = deadline - Date.now();
+    if (remainingMilliseconds <= 0) {
+      break;
+    }
     try {
-      const downloaded = await downloadImplementation(url, { allowInsecureURL });
+      const downloaded = await downloadImplementation(url, {
+        allowInsecureURL,
+        timeoutMilliseconds: remainingMilliseconds,
+      });
       const binary = Buffer.isBuffer(downloaded) ? downloaded : Buffer.from(downloaded);
       if (digest(binary) !== expectedChecksum) {
         throw new Error(`checksum mismatch for ${asset}`);
@@ -235,8 +263,18 @@ async function downloadVerifiedBinary({
   );
 }
 
-async function downloadWithCurl(url, { allowInsecureURL = false } = {}) {
+export async function downloadWithCurl(
+  url,
+  {
+    allowInsecureURL = false,
+    timeoutMilliseconds = BINARY_DOWNLOAD_TIMEOUT_MILLISECONDS,
+    maxTimeSeconds = 600,
+    retryDelaySeconds = 2,
+  } = {},
+) {
   const parsed = parseDownloadBaseURL(url, allowInsecureURL);
+  const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "viceme-curl-"));
+  const outputPath = path.join(temporaryDirectory, "download");
   const arguments_ = [
     "--fail",
     "--location",
@@ -244,45 +282,61 @@ async function downloadWithCurl(url, { allowInsecureURL = false } = {}) {
     "--show-error",
     "--connect-timeout",
     "10",
+    // The release binary is tens of megabytes, so allow one healthy transfer
+    // to use the full download budget. curl owns transient retry
+    // classification, while the Node child timeout bounds all retries and
+    // mirrors together. Only curl 7.12+ options are used.
     "--max-time",
-    "120",
+    String(maxTimeSeconds),
+    "--retry",
+    "3",
+    "--retry-delay",
+    String(retryDelaySeconds),
     "--max-redirs",
     "5",
+    // curl can reset a regular output file before retrying. A stdout pipe
+    // retains partial bytes and would concatenate them with the next attempt.
+    "--output",
+    outputPath,
   ];
   if (!allowInsecureURL) {
     arguments_.push("--proto", "=https", "--proto-redir", "=https");
   }
   arguments_.push(parsed.href);
-  return await new Promise((resolve, reject) => {
-    const child = spawn("curl", arguments_, {
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-    });
-    const stdout = [];
-    let stderr = "";
-    child.stdout.on("data", (chunk) => stdout.push(chunk));
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on("error", (error) => {
-      if (error.code === "ENOENT") {
-        reject(new Error("curl is required to download the ViceMe CLI binary"));
-        return;
-      }
-      reject(error);
-    });
-    child.on("close", (code, signal) => {
-      if (code === 0) {
-        resolve(Buffer.concat(stdout));
-        return;
-      }
-      const reason = stderr.trim() || `curl exited ${code ?? `on signal ${signal}`}`;
-      reject(new Error(reason));
+  try {
+    await new Promise((resolve, reject) => {
+      const child = spawn("curl", arguments_, {
+        stdio: ["ignore", "ignore", "pipe"],
+        timeout: Math.max(1, Math.ceil(timeoutMilliseconds)),
+        windowsHide: true,
+      });
+      let stderr = "";
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+      });
+      child.on("error", (error) => {
+        if (error.code === "ENOENT") {
+          reject(new Error("curl is required to download the ViceMe CLI binary"));
+          return;
+        }
+        reject(error);
+      });
+      child.on("close", (code, signal) => {
+        if (code === 0) {
+          resolve();
+          return;
+        }
+        const reason = stderr.trim() || `curl exited ${code ?? `on signal ${signal}`}`;
+        reject(new Error(reason));
+      });
     });
-  });
+    return await readFile(outputPath);
+  } finally {
+    await rm(temporaryDirectory, { recursive: true, force: true });
+  }
 }
 
-async function findValidGeneration(generationsDirectory, asset) {
+async function findValidGeneration(generationsDirectory, asset, expectedChecksum) {
   let entries;
   try {
     entries = await readdir(generationsDirectory, { withFileTypes: true });
@@ -296,7 +350,7 @@ async function findValidGeneration(generationsDirectory, asset) {
     .filter((candidate) => candidate.isDirectory() && candidate.name.startsWith(GENERATION_PREFIX))
     .sort((left, right) => left.name.localeCompare(right.name))) {
     const binaryPath = path.join(generationsDirectory, entry.name, asset);
-    if (await cachedBinaryIsValid(binaryPath, `${binaryPath}.sha256`)) {
+    if (await binaryMatchesChecksum(binaryPath, expectedChecksum)) {
       return binaryPath;
     }
   }
@@ -316,15 +370,13 @@ function defaultCacheDirectory(environment, platform) {
   return path.join(os.homedir(), ".cache", "viceme");
 }
 
-async function cachedBinaryIsValid(binaryPath, checksumPath) {
+async function binaryMatchesChecksum(binaryPath, expectedChecksum) {
   try {
-    const [binary, checksumDocument] = await Promise.all([
+    const [binary] = await Promise.all([
       readFile(binaryPath),
-      readFile(checksumPath, "utf8"),
       access(binaryPath, constants.X_OK),
     ]);
-    const expected = parseChecksum(checksumDocument);
-    return digest(binary) === expected;
+    return digest(binary) === expectedChecksum;
   } catch {
     return false;
   }
@@ -353,14 +405,6 @@ function checksumForAsset(document, asset) {
   return checksum;
 }
 
-function parseChecksum(document) {
-  const match = document.trim().match(/^([a-fA-F0-9]{64})(?:\s|$)/);
-  if (!match) {
-    throw new Error("release checksum document is invalid");
-  }
-  return match[1].toLowerCase();
-}
-
 function digest(buffer) {
   return createHash("sha256").update(buffer).digest("hex");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {