@volcengine/ark-cli 1.0.0 → 1.0.2

package/manifest.json

@@ -1,40 +1,64 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.2",
   "platforms": {
     "darwin-amd64": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/arkcli-1.0.0-darwin-amd64",
-      "sha256": "9b517875fe9ab806fdbfc5ddc3db090fac38366561f657558b00cd661becf030"
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/arkcli-1.0.2-darwin-amd64",
+      "sha256": "ba7e088f5c2617b52de00c3b3017ee460ce56288ff654a4badbe7561d800136e",
+      "fallback": {
+        "url": "https://github.com/volcengine/ark-cli/releases/download/v1.0.2/arkcli-1.0.2-darwin-amd64",
+        "kind": "github-release"
+      }
     },
     "darwin-arm64": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/arkcli-1.0.0-darwin-arm64",
-      "sha256": "c90b842896ea8d3a22573b997d611a0ebbe1e4a5cb016113ef656c7d572bc4a8"
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/arkcli-1.0.2-darwin-arm64",
+      "sha256": "32e4b560dc7a3ba9f5247e18e7359d1a050fbd4412cf75afcef9d98ed619c990",
+      "fallback": {
+        "url": "https://github.com/volcengine/ark-cli/releases/download/v1.0.2/arkcli-1.0.2-darwin-arm64",
+        "kind": "github-release"
+      }
     },
     "linux-amd64": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/arkcli-1.0.0-linux-amd64",
-      "sha256": "48e026b727c9c47476dcd9bf8d4369cf11a7fff3b3ed4ac89abb558abed61681"
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/arkcli-1.0.2-linux-amd64",
+      "sha256": "2eb1630e5d90f3a572a8bf190a5dbe212435789d9456fcdb2cee029dc50ef476",
+      "fallback": {
+        "url": "https://github.com/volcengine/ark-cli/releases/download/v1.0.2/arkcli-1.0.2-linux-amd64",
+        "kind": "github-release"
+      }
     },
     "linux-arm64": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/arkcli-1.0.0-linux-arm64",
-      "sha256": "4f347c790c2b40b30bd7f8bc73b6a88f1ed40303b86f5b19021943ce47871a37"
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/arkcli-1.0.2-linux-arm64",
+      "sha256": "b79b92878ba0ebe81b48f15a7b3f6be69cf22de4c84799ef921f075f11be2eae",
+      "fallback": {
+        "url": "https://github.com/volcengine/ark-cli/releases/download/v1.0.2/arkcli-1.0.2-linux-arm64",
+        "kind": "github-release"
+      }
     },
     "windows-amd64": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/arkcli-1.0.0-windows-amd64.exe",
-      "sha256": "566dd1d9b2ba03b109ee1946f968f7501db6e80f4215ab7f3ce2715ab61a1aa5"
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/arkcli-1.0.2-windows-amd64.exe",
+      "sha256": "c41b597ec6aedca8bfcc5ddc7e2862d26142e5bb83eed63715a23371666602c0",
+      "fallback": {
+        "url": "https://github.com/volcengine/ark-cli/releases/download/v1.0.2/arkcli-1.0.2-windows-amd64.exe",
+        "kind": "github-release"
+      }
     },
     "windows-arm64": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/arkcli-1.0.0-windows-arm64.exe",
-      "sha256": "eebd43f2bdd53a3d3d8f6abe677ab58d7abe50785e72c3ab143c979f750a0a5d"
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/arkcli-1.0.2-windows-arm64.exe",
+      "sha256": "e8e15cda610bf0ac6697e9226f629af537a0540f66d528834496900e6b61bc6c",
+      "fallback": {
+        "url": "https://github.com/volcengine/ark-cli/releases/download/v1.0.2/arkcli-1.0.2-windows-arm64.exe",
+        "kind": "github-release"
+      }
     }
   },
   "skills": {
     "primary": {
-      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.0/skills.tar.gz",
-      "sha256": "918ed10a94dc7291a5291ac62705237fb10b46112374eadf7d16eba33e3ca4ff",
+      "url": "https://lf3-static.bytednsdoc.com/obj/eden-cn/psjryh/ljhwZthlaukjlkulzlp/prod/1.0.2/skills.tar.gz",
+      "sha256": "08ef3ddf5a8168b93d8623748a6c887b83f514448e10789fa3b6ee95fc509fa0",
       "kind": "cdn"
     },
-    "tag": "v1.0.0",
+    "tag": "v1.0.2",
     "fallback": {
-      "url": "https://github.com/volcengine/ark-cli/archive/refs/tags/v1.0.0.tar.gz",
+      "url": "https://github.com/volcengine/ark-cli/archive/refs/tags/v1.0.2.tar.gz",
       "kind": "github"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volcengine/ark-cli",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "火山方舟 ARK 平台命令行工具",
   "bin": {
     "arkcli": "scripts/run.js"

package/scripts/postinstall.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 // @volcengine/ark-cli postinstall。
 // 由 npm 的 postinstall lifecycle 触发:读 manifest.json,按当前平台从 CDN 下载
-// 对应二进制,校验 sha256,落到 <pkg>/bin/,然后(非 CI 时)调 `arkcli +connect
+// 对应二进制;稳定版 CDN 失败时回退 GitHub Release asset。下载后统一校验
+// manifest 里的 sha256,落到 <pkg>/bin/,然后(非 CI 时)调 `arkcli +connect
 // --refresh` —— 由二进制【收口的 Go 实现】下载最新 skill 到 <pkg>/skills/ 再装进
 // 各 agent。skill 的下载/解压/校验逻辑不再在本脚本维护(避免 node / Go 两份),
 // 与用户手动 `arkcli +connect --refresh` 重装/刷新【共用同一份实现】。
@@ -12,7 +13,7 @@
 //   - 二进制不内嵌,运行时从 CDN 按平台下载
 //
 // 失败策略:
-//   - 下载/校验二进制 = 核心,失败则 exit 1(没有二进制这个包不可用,fail loud)
+//   - 下载/校验二进制 = 核心,所有源失败则 exit 1(没有二进制这个包不可用,fail loud)
 //   - +connect --refresh(下 skill + 装 agent) = 增强,失败仅告警,不影响安装结果(exit 0)
 
 const fs = require("fs");
@@ -55,7 +56,11 @@ try {
 
 const entry = manifest.platforms && manifest.platforms[key];
 if (!entry || !entry.url) {
-  console.error(`@volcengine/ark-cli: no CDN entry for platform ${key} in manifest`);
+  console.error(`@volcengine/ark-cli: no binary entry for platform ${key} in manifest`);
+  process.exit(1);
+}
+if (!/^[0-9a-f]{64}$/i.test(entry.sha256 || "")) {
+  console.error(`@volcengine/ark-cli: missing or malformed sha256 for platform ${key}`);
   process.exit(1);
 }
 
@@ -66,31 +71,38 @@ function httpMod(url) {
   return url.startsWith("http://") ? http : https;
 }
 
-// 下载到临时文件,跟随 3xx 重定向(CDN 边缘常有跳转)。
+// 下载到临时文件,跟随 3xx 重定向(CDN/GitHub 边缘常有跳转)。
 function download(url, dest, redirects = 0) {
   return new Promise((resolve, reject) => {
     if (redirects > 5) return reject(new Error("too many redirects"));
-    const file = fs.createWriteStream(dest);
     const req = httpMod(url).get(url, (res) => {
       if (
         res.statusCode >= 300 &&
         res.statusCode < 400 &&
         res.headers.location
       ) {
-        file.close();
-        fs.rmSync(dest, { force: true });
-        return resolve(download(res.headers.location, dest, redirects + 1));
+        res.resume();
+        const nextURL = new URL(res.headers.location, url).toString();
+        return resolve(download(nextURL, dest, redirects + 1));
       }
       if (res.statusCode !== 200) {
-        file.close();
-        fs.rmSync(dest, { force: true });
+        res.resume();
         return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
       }
+      const file = fs.createWriteStream(dest);
+      file.on("error", (err) => {
+        fs.rmSync(dest, { force: true });
+        reject(err);
+      });
+      res.on("error", (err) => {
+        file.close();
+        fs.rmSync(dest, { force: true });
+        reject(err);
+      });
       res.pipe(file);
       file.on("finish", () => file.close(() => resolve()));
     });
     req.on("error", (err) => {
-      file.close();
       fs.rmSync(dest, { force: true });
       reject(err);
     });
@@ -101,38 +113,64 @@ function sha256(file) {
   return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 }
 
+function binarySources(entry) {
+  const sources = [{ kind: entry.kind || "cdn", url: entry.url }];
+  if (entry.fallback && entry.fallback.url) {
+    sources.push({
+      kind: entry.fallback.kind || "fallback",
+      url: entry.fallback.url,
+    });
+  }
+  return sources;
+}
+
+async function downloadVerifiedBinary(sources, dest, expectedSHA) {
+  const errors = [];
+  for (const src of sources) {
+    fs.rmSync(dest, { force: true });
+    try {
+      console.log(`@volcengine/ark-cli: downloading ${key} binary from ${src.kind}...`);
+      await download(src.url, dest);
+      if (expectedSHA) {
+        const actual = sha256(dest);
+        if (actual !== expectedSHA.toLowerCase()) {
+          throw new Error(
+            `sha256 mismatch\n  expected ${expectedSHA}\n  actual   ${actual}`,
+          );
+        }
+      }
+      return src;
+    } catch (err) {
+      fs.rmSync(dest, { force: true });
+      errors.push(`${src.kind}: ${err.message || err}`);
+      console.warn(
+        `@volcengine/ark-cli: ${src.kind} binary source failed: ${err.message || err}`,
+      );
+    }
+  }
+  throw new Error(errors.join("; "));
+}
+
 (async () => {
   fs.mkdirSync(binDir, { recursive: true });
   const tmp = `${binPath}.download`;
 
+  let installedFrom;
   try {
-    console.log(`@volcengine/ark-cli: downloading ${key} binary from CDN...`);
-    await download(entry.url, tmp);
+    installedFrom = await downloadVerifiedBinary(binarySources(entry), tmp, entry.sha256);
   } catch (err) {
     fs.rmSync(tmp, { force: true });
     console.error(`@volcengine/ark-cli: download failed: ${err.message || err}`);
     process.exit(1);
   }
 
-  // sha256 完整性校验(烘焙时一定写入 entry.sha256)
-  if (entry.sha256) {
-    const actual = sha256(tmp);
-    if (actual !== entry.sha256) {
-      fs.rmSync(tmp, { force: true });
-      console.error(
-        `@volcengine/ark-cli: sha256 mismatch for ${key}\n` +
-          `  expected ${entry.sha256}\n` +
-          `  actual   ${actual}`,
-      );
-      process.exit(1);
-    }
-  }
-
   fs.renameSync(tmp, binPath);
   if (platform !== "windows") {
     fs.chmodSync(binPath, 0o755);
   }
-  console.log(`@volcengine/ark-cli: installed ${path.basename(binPath)}`);
+  console.log(
+    `@volcengine/ark-cli: installed ${path.basename(binPath)} from ${installedFrom.kind}`,
+  );
 
   // CI 环境:不下 skill、不 +connect(无 agent 交互场景,且 CI 常无外网),直接收工。
   if (process.env.CI === "true" || process.env.CI === "1") {