@vzn/vx 0.0.21 → 0.0.23

package/src/cli/upgrade.ts

@@ -1,6 +1,11 @@
 // `vx upgrade [tag]` — self-update the compiled binary in place.
-// Downloads the GitHub release asset for this os/arch, writes next to
-// the current executable, atomic rename over it.
+// Asks the GitHub release API for the asset of this os/arch and the
+// SHA-256 digest it publishes, downloads the asset, verifies the digest,
+// writes next to the current executable, atomic rename over it. The
+// digest is what makes a cut transfer (a proxy that drops a connection,
+// a disk that fills) or a swapped asset a refusal instead of a binary
+// that does not start: the rename is the last step, and a mismatch
+// replaces nothing.
 // Named `upgrade` (not `update`) per CLI convention: bun upgrade,
 // deno upgrade — "update" is what package managers do to indexes.
 
@@ -35,6 +40,25 @@ function isCompiledBinary(): boolean {
   )
 }
 
+/**
+ * The package directory that owns `execPath` when it sits under a
+ * `node_modules` — an npm install's platform binary, which the launcher
+ * runs as `…/node_modules/@vzn/vx-<os>-<arch>/vx`. That file is npm's:
+ * a rename over it upgrades this command until the next `npm install`
+ * (or a lockfile-pinned CI checkout) puts the version npm knows back,
+ * and `npm ls` never agrees with `vx --version` in between. Such an
+ * install updates through npm, and `vx upgrade` says so. Null for a
+ * binary installed by hand from a release.
+ */
+export function npmOwnedBinary(execPath: string): string | null {
+  const parts = execPath.split(/[\\/]/)
+  const at = parts.lastIndexOf('node_modules')
+  if (at === -1) return null
+  const scoped = parts[at + 1]?.startsWith('@') === true
+  const pkg = parts.slice(at + 1, at + (scoped ? 3 : 2)).join('/')
+  return pkg.length > 0 ? pkg : 'node_modules'
+}
+
 function assetName(): string {
   const os = process.platform === 'darwin' ? 'darwin' : process.platform
   const arch = process.arch === 'x64' || process.arch === 'arm64' ? process.arch : null
@@ -44,14 +68,102 @@ function assetName(): string {
   return `vx-${os}-${arch}`
 }
 
+/** What the release API says about the asset this platform installs. */
+export interface ReleaseAsset {
+  url: string
+  /** Lower-case hex SHA-256 of the asset's bytes. */
+  sha256: string
+}
+
+/**
+ * Pick this platform's asset out of a release document and read the
+ * digest the API publishes for it (`sha256:<hex>` on every asset a
+ * release built through `release.yml` carries). A release without the
+ * asset, or an asset without a digest, is refused here: an upgrade that
+ * cannot be verified is not attempted.
+ */
+export function releaseAsset(release: unknown, name: string): ReleaseAsset {
+  const tag =
+    typeof release === 'object' &&
+    release !== null &&
+    typeof (release as { tag_name?: unknown }).tag_name === 'string'
+      ? (release as { tag_name: string }).tag_name
+      : '(unknown)'
+  const assets =
+    typeof release === 'object' &&
+    release !== null &&
+    Array.isArray((release as { assets?: unknown }).assets)
+      ? (release as { assets: unknown[] }).assets
+      : []
+  const asset = assets.find(
+    (a): a is { name: string; browser_download_url?: unknown; digest?: unknown } =>
+      typeof a === 'object' && a !== null && (a as { name?: unknown }).name === name,
+  )
+  if (asset === undefined) {
+    throw new UserError(`vx upgrade: release ${tag} has no asset ${name} for this platform`)
+  }
+  const url = asset.browser_download_url
+  if (typeof url !== 'string' || url.length === 0) {
+    throw new UserError(`vx upgrade: release ${tag} names no download for ${name}`)
+  }
+  const digest = asset.digest
+  const m = typeof digest === 'string' ? /^sha256:([0-9a-f]{64})$/i.exec(digest) : null
+  if (m === null) {
+    throw new UserError(
+      `vx upgrade: release ${tag} publishes no SHA-256 digest for ${name} — nothing to verify the download against, so it is not attempted`,
+    )
+  }
+  return { url, sha256: m[1]!.toLowerCase() }
+}
+
+/**
+ * `fetch` on a box that cannot reach the host rejects with Bun's own
+ * `TypeError` ("Unable to connect. Is the computer able to access the
+ * url?", "Was there a typo in the url or port?"), which the CLI printed
+ * as an internal error with a stack (a network namespace without a
+ * route, 2026-09-16). One line, the host and the reason.
+ */
+async function fetchOrRefuse(url: string, init: RequestInit, what: string): Promise<Response> {
+  try {
+    return await fetch(url, init)
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    throw new UserError(
+      `vx upgrade: could not reach ${new URL(url).host} to ${what} (${message}) — check the network or the proxy and re-run`,
+    )
+  }
+}
+
+/** The release document for `latest` or a tag, from the GitHub API. */
+async function fetchRelease(tag: string | undefined): Promise<unknown> {
+  const url =
+    tag === undefined
+      ? `https://api.github.com/repos/${REPO}/releases/latest`
+      : `https://api.github.com/repos/${REPO}/releases/tags/${encodeURIComponent(tag)}`
+  const res = await fetchOrRefuse(
+    url,
+    {
+      redirect: 'follow',
+      headers: { Accept: 'application/vnd.github+json', 'User-Agent': `vx/${VERSION}` },
+    },
+    'read the release',
+  )
+  if (!res.ok) {
+    throw new UserError(
+      `vx upgrade: could not read the release (${res.status}) — ${url}${res.status === 404 && tag !== undefined ? ` (is ${tag} a release tag?)` : ''}`,
+    )
+  }
+  return (await res.json()) as unknown
+}
+
 /**
- * Download `url` and atomically replace `dest` with it. Exported for
- * tests (which point `url` at a local server and `dest` at a tmp
- * file); the CLI wires it to the GitHub release asset and
- * process.execPath.
+ * Download `url`, verify its SHA-256 against `sha256`, and atomically
+ * replace `dest` with it. Exported for tests (which stub `fetch` and
+ * point `dest` at a tmp file); the CLI wires it to the release asset
+ * and process.execPath.
  */
-export async function replaceBinary(dest: string, url: string): Promise<void> {
-  const res = await fetch(url, { redirect: 'follow' })
+export async function replaceBinary(dest: string, url: string, sha256: string): Promise<void> {
+  const res = await fetchOrRefuse(url, { redirect: 'follow' }, 'download the release asset')
   if (!res.ok) {
     throw new UserError(`vx upgrade: download failed (${res.status}) — ${url}`)
   }
@@ -59,6 +171,12 @@ export async function replaceBinary(dest: string, url: string): Promise<void> {
   if (bytes.byteLength === 0) {
     throw new UserError(`vx upgrade: empty download — ${url}`)
   }
+  const got = new Bun.CryptoHasher('sha256').update(bytes).digest('hex')
+  if (got !== sha256.toLowerCase()) {
+    throw new UserError(
+      `vx upgrade: the download did not match the release's SHA-256 (expected ${sha256}, got ${got}) — nothing replaced; try again, and if it repeats the asset is not the one the release published`,
+    )
+  }
   const tmp = `${dest}.upgrade-${process.pid}`
   try {
     await Bun.write(tmp, bytes)
@@ -88,14 +206,16 @@ export async function upgradeCmd(args: readonly string[]): Promise<number> {
         '(npm installs update with: npm install -g @vzn/vx@latest)',
     )
   }
-  const asset = assetName()
-  const url =
-    tag === undefined
-      ? `https://github.com/${REPO}/releases/latest/download/${asset}`
-      : `https://github.com/${REPO}/releases/download/${tag}/${asset}`
   const dest = process.execPath
+  const owner = npmOwnedBinary(dest)
+  if (owner !== null) {
+    throw new UserError(
+      `vx upgrade: this vx was installed by npm (${dest} belongs to ${owner}) — npm owns that file, and the next npm install would put the version it knows back. Update with: npm install -g @vzn/vx@latest`,
+    )
+  }
+  const asset = releaseAsset(await fetchRelease(tag), assetName())
   process.stdout.write(`vx upgrade: ${VERSION} → ${tag ?? 'latest'} (${dest})\n`)
-  await replaceBinary(dest, url)
+  await replaceBinary(dest, asset.url, asset.sha256)
   // Report the replaced binary's own version — the new build speaks
   // for itself rather than this process guessing.
   const proc = Bun.spawnSync({ cmd: [dest, '--version'], stdout: 'pipe', stderr: 'pipe' })